An inappropriate implementation in the WebGL subsystem of Google Chrome on Android enables a remote attacker to read data that originates from a different origin by presenting a specially crafted HTML page. This flaw does not grant code execution or privilege escalation; instead, it allows the disclosure of information that should remain isolated, such as data stored in WebGL contexts. It is identified as a CWE‑200 Information Exposure and a CWE‑346 Missing Authentication for a Critical Function, and Chromium lists it as a high‑severity issue.

Android installations running Google Chrome versions earlier than 148.0.7778.216 are affected. The vulnerability exists only in the Android build of Chrome and does not impact desktop or other operating systems.

An attacker can trigger the data leak by serving or visiting a malicious HTML page that exploits the WebGL bug. No special privileges or authentication are required, making the attack possible from any website the user opens. The CVSS score of 6.5 indicates a moderate‑to‑high risk, while an EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog.