An inappropriate implementation in the WebGL subsystem of Google Chrome on Android enables a remote attacker to read data that originates from a different origin by presenting a specially crafted HTML page. This flaw does not grant code execution or privilege escalation; instead, it allows the disclosure of information that should remain isolated, such as data stored in WebGL contexts. It is identified as CWE‑346 Missing Authentication for a Critical Function and also represents a CWE‑200 Information Exposure weakness, and Chromium lists it as a high‑severity issue.

Android installations running Google Chrome versions earlier than 148.0.7778.216 are affected. The vulnerability exists only in the Android build of Chrome and does not impact desktop or other operating systems.

The likely attack vector is a malicious HTML page that exploits the WebGL bug, allowing the attacker to trigger the data leak. It is inferred from the description that no special privileges or authentication are required, making the attack possible from any website the user opens. The CVSS score of 4.3 indicates a moderate risk, while an EPSS score of less than 1% shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog.