This vulnerability arises from an inappropriate implementation in the user interface of Google Chrome on Android before version 151.0.7922.72. A remote attacker can exploit this by convincing a user to perform certain UI gestures on a maliciously crafted HTML page, resulting in leakage of cross-origin data. The issue is classified under CWE-451 (Incorrect Expression of Intent). The CVSS v3.1 base score is 3.1, indicating low severity, with attack vector network, high attack complexity, no privileges required, user interaction required, and impact limited to confidentiality.

The impact is limited to the confidentiality of data, specifically cross-origin data leakage. There is no impact on integrity or availability. Exploitation requires user interaction and specific UI gestures, making exploitation more difficult. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory linked does not explicitly state a fix or remediation level. Users should update to version 151.0.7922.72 or later once confirmed. Until then, caution with untrusted web content and UI gestures is advised.