In Google Chrome for Android, a flaw in the user interface allows a remote attacker to get a user to perform specific gestures on a web page. By combining these gestures with a crafted HTML page, the attacker can read data that originates from a different origin, leaking information across web sites. The weakness is reflected in CWE‑451, which denotes information exposure through incorrect neutralization. This vulnerability grants an attacker the ability to exfiltrate cross‑origin data but does not provide direct code execution or denial of service.

All installations of Google Chrome running on Android devices with a version earlier than 151.0.7922.72 are affected.

The CVSS score is 3.1, indicating low severity, and the EPSS score is below 1 %, which means the probability of exploitation is very low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires user cooperation: an attacker must trick a user into opening a crafted web page and performing particular UI gestures, making a successful attack less likely in typical circumstances. The attack vector is therefore UI‑gesture based and user‑interactive.