This vulnerability arises from an inappropriate implementation in the Payments component of Google Chrome on Android versions before 149.0.7827.53. A remote attacker with control over the renderer process can exploit this flaw to spoof domains through a specially crafted HTML page. The issue is tracked as CVE-2026-11019 and is associated with CWE-290 (Authentication Bypass) and CWE-451 (User Interface Misrepresentation). The CVSS v3.1 base score is 6.5, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory URL points to a Chrome stable channel update announcement but does not explicitly confirm patch availability or remediation status for this specific issue.

The vulnerability allows a remote attacker who has already compromised the renderer process to perform domain spoofing, potentially misleading users by misrepresenting the origin of web content. This impacts the integrity of the browsing experience but does not affect confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since this is a client-side vulnerability in Chrome on Android, users should update to version 149.0.7827.53 or later once confirmed by the vendor. Until then, no specific mitigation steps are provided by the vendor advisory.