This vulnerability is a race condition (CWE-457: Use of Uninitialized Variable) in the GPU subsystem of Google Chrome on Android versions before 149.0.7827.53. An attacker with control over the renderer process can exploit this flaw to leak data from other origins, violating the same-origin policy. The CVSS 3.1 base score is 6.5 (Medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. There is no explicit vendor advisory stating a patch or remediation level, but the affected versions list includes 149.0.7827.53, implying that this version is the fixed release.

Successful exploitation allows a remote attacker who has compromised the renderer process to leak sensitive cross-origin data, breaching confidentiality. There is no impact on integrity or availability. This could lead to unauthorized disclosure of information accessible to the browser, potentially exposing user data or session information.

The vulnerability is fixed in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory. Patch status is inferred from the affectedVersions field and vendor blog URL referencing stable channel updates. Monitor official Google Chrome release notes for confirmation.