The vulnerability is a confused deputy flaw in Chrome Mobile on Android. An attacker who is able to co‑install a malicious application can trick or manipulate the browser into exposing sensitive information to the co‑installed app. This leads to the disclosure of private data that the Chrome instance may have access to.

Affected by the bug are users of Google Chrome Mobile on Android versions prior to 154.0.8037.57. The flaw is embedded in the mobile packaging and applies to applications that have been installed alongside Chrome and can therefore read information shared through the browser context.

The CVSS score of 6.5 indicates a moderate impact with local access. No EPSS data is available and the issue is not listed in CISA KEV. The likely attack vector requires the user to install a co‑installed application that can obtain the exposed data. The exploit hinges on social engineering, so preventing or disabling co‑installed apps or mitigating user training reduces risk.