This vulnerability arises from insufficient enforcement of security policies in the PreviewTab component of Google Chrome on Android before version 149.0.7827.53. An attacker can exploit this by tricking a user into performing certain UI gestures on a maliciously crafted HTML page, resulting in a bypass of the same origin policy. The same origin policy is a critical browser security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The Chromium security team classifies this issue as low severity, indicating limited impact or exploitability. The vendor advisory linked does not explicitly confirm patch availability or remediation status.

The impact is a bypass of the same origin policy in affected versions of Google Chrome on Android, potentially allowing unauthorized access to web content across origins under specific user interaction conditions. However, the severity is rated low by the Chromium security team, and there are no known exploits in the wild. This suggests limited practical impact or difficulty in exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 149.0.7827.53 or later once confirmed. Until then, caution users about interacting with untrusted web content that might attempt to exploit UI gestures. No official fix or temporary workaround is explicitly stated in the advisory.