This vulnerability in Google Chrome on Android versions before 150.0.7871.47 arises from an inappropriate implementation in the Sharing functionality. An attacker with control over the renderer process can exploit this flaw by crafting a malicious HTML page to leak data across origins, violating the same-origin policy. The issue is limited to scenarios where the renderer process is already compromised. The vulnerability is classified as medium severity by Chromium security. No CVSS score is provided. The vendor advisory linked does not explicitly state the patch or remediation status.

The vulnerability allows an attacker who has compromised the renderer process to leak cross-origin data, potentially exposing sensitive information from other origins. This compromises data confidentiality within the affected browser environment on Android devices. There is no indication of remote code execution or privilege escalation beyond the renderer compromise. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 150.0.7871.47 or later once the update is confirmed to address this issue. Until then, limiting exposure to untrusted content and avoiding compromise of the renderer process are advisable.