An insufficient policy enforcement vulnerability in Google Chrome on Android prior to version 148.0.7778.96 allows local attackers to achieve privilege escalation via a malicious file.

This is an insufficient policy enforcement flaw in the DevTools component that requires local access and user interaction to execute. The authentication level required is none, though user interaction is necessary to process the malicious file.

A successful exploit of this vulnerability can lead to total technical impact, compromising the confidentiality, integrity, and availability of the affected mobile device. With a CVSS score of 7.8, the severity is high, presenting significant risk for unauthorized access and potential data compromise on enterprise mobile endpoints.

Immediate Action: Update Google Chrome on Android to version 148.0.7778.96 or later.

Proactive Monitoring: Monitor mobile device management (MDM) platforms to ensure all deployed instances of Google Chrome on Android are updated to the patched version.

Compensating Controls: Enforce strict application whitelisting and user education policies to prevent the execution of untrusted or malicious local files on mobile devices.

Public Exploit Available: false

This high-severity vulnerability poses a substantial risk to mobile endpoint security by enabling local privilege escalation. Administrators must prioritize updating Google Chrome on Android across all managed devices to version 148.0.7778.96 immediately to eliminate the attack vector.