The flaw lies in insufficient enforcement of USB policy in Google Chrome for Android versions prior to 151.0.7922.72. A malicious HTML page that reaches a renderer process already compromised by an attacker can cause the browser to expose cross‑origin data that should have been protected, leading to confidential information leakage that the attacker can read.

Google Chrome for Android builds earlier than 151.0.7922.72. All Android devices running these legacy Chrome versions are potentially vulnerable, regardless of the underlying OS, because the vulnerability is embedded in the browser code.

The CVSS score of 3.1 indicates low severity, and the EPSS likelihood of <1% shows a very small chance of exploitation. The flaw is not listed in CISA’s KEV catalog, meaning no known public exploit exists. Practical exploitation would require an attacker to first compromise the renderer process and then deliver a crafted HTML payload, which limits real-world threat but still poses a confidentiality risk for users with sensitive cross‑origin content.