This vulnerability involves an inappropriate implementation in the Cronet network stack of Google Chrome on Android, which enables remote attackers to spoof domains via specially crafted domain names. The affected versions are those prior to 149.0.7827.53. The vulnerability was published on June 4, 2026, and is rated medium severity by Chromium security. No CVSS score or detailed technical exploitation information is provided. The vendor advisory URL is available but does not explicitly confirm patch availability or remediation steps.

The impact is domain spoofing, which could potentially mislead users or systems relying on domain validation within Chrome on Android. This could facilitate phishing or other social engineering attacks. However, no known exploits in the wild have been reported, and the severity is medium as per Chromium security assessment.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since no explicit patch or remediation level is provided in the data, users should monitor official Google Chrome updates and apply the latest version 149.0.7827.53 or later when available to mitigate this vulnerability.