This vulnerability in Google Chrome on Android versions before 149.0.7827.53 is caused by insufficient validation of untrusted input in the Tab Group Sync component. An attacker can exploit this flaw by sending malicious network traffic that injects arbitrary scripts or HTML, leading to a UXSS attack. The CVSS 3.1 base score is 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. The vulnerability is publicly known but no known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

Successful exploitation allows remote attackers to inject arbitrary scripts or HTML content into the browser context via the Tab Group Sync feature, potentially leading to UXSS attacks. This can compromise user data confidentiality and integrity within the affected browser session. There is no reported impact on system availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 149.0.7827.53 or later once the fix is confirmed. Until then, exercise caution with untrusted network content and consider disabling Tab Group Sync if feasible.