This vulnerability affects the Payments feature in Google Chrome on Android before version 149.0.7827.53. It arises from an inappropriate implementation that enables an attacker with control over the renderer process to spoof domains through a specially crafted HTML page. This could mislead users about the authenticity of payment-related content. The issue is recognized as medium severity by Chromium security. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

If exploited, an attacker who has compromised the renderer process could perform domain spoofing, potentially misleading users during payment interactions. This could undermine user trust and facilitate phishing or fraudulent payment activities. However, exploitation requires prior compromise of the renderer process, limiting the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 149.0.7827.53 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.