An incorrect authorization check in WebAPKs in Google Chrome for Android prior to 154.0.8037.57 allows a local attacker who can install a malicious co‑application to read data belonging to a WebAPK of a different origin, effectively bypassing the expected origin boundary and leaking confidential information. This vulnerability is classified as an improper privilege management weakness (CWE‑863) and can lead to confidentiality compromise of data stored or displayed by affected WebAPKs.

The flaw affects Google Chrome on Android installations using any version earlier than 154.0.8037.57. Devices running these versions are vulnerable if WebAPK functionality is enabled and a malicious co‑installed application is present.

The CVSS score of 2.9 indicates a moderate severity assessment. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited prior exploitation. The attack vector is local and requires the attacker to install a malicious co‑application, meaning exploitation depends on user behavior and device policies. Organizations that allow installation from unknown sources or use WebAPKs to handle sensitive data should treat this as a medium‑risk issue and consider immediate patching or additional controls.