The vulnerability stems from insufficient policy enforcement within the NFC subsystem of Google Chrome on Android. An attacker can deliver a specially crafted HTML page that, when opened in Chrome, bypasses enforced checks and causes the browser to read and transmit data from a different origin. This results in leakage of potentially sensitive cross‑origin information, reflecting CWE‑346 which denotes a lack of adequate authentication or authorization for data sources.

The issue appears in Google Chrome for Android versions prior to 151.0.7922.72. Any device running a vulnerable build of Chrome on Android is susceptible.

The CVSS score of 4.3 indicates a low severity vulnerability. The EPSS score of < 1% points to an extremely low likelihood that the weakness will be actively exploited in the wild at the present time. The vulnerability is not listed in the CISA KEV catalog, further supporting its marginal threat level. The attack vector is believed to be remote, requiring the victim to load a malicious web page that uses NFC features to access cross‑origin data, suggesting that typical user browsing could trigger exploitation if an attacker controls the loaded content.