The vulnerability arises from insufficient policy enforcement in the Network component of Google Chrome for Android. A crafted HTML page can exploit a compromised renderer process to read data from other origins, enabling a remote attacker to leak cross‑origin confidential information. The primary impact is information disclosure and is classified as Medium severity by Chromium's security team.

This flaw affects Google Chrome installations on Android devices running any version prior to 148.0.7778.168. The affected component is the Network module within the renderer process. Users of older Android Chrome releases are at risk; newer releases beyond the noted version are presumed fixed.

The CVSS score is 3.1, a low severity rating, and the EPSS score is less than 1%, indicating a very low probability of exploitation in the wild. The vulnerability requires a remote attacker to have already compromised the renderer process to craft a malicious HTML page; therefore exploitation is limited to situations where the renderer has been subverted, such as via another vulnerability or malicious app. The flaw does not provide arbitrary code execution but allows leaking of cross‑origin data, representing an information disclosure risk.