This vulnerability arises from insufficient validation of untrusted input in the Omnibox component of Google Chrome before version 149.0.7827.53. An attacker can exploit this by tricking a user into performing certain UI gestures on a maliciously crafted HTML page, leading to the injection of arbitrary scripts or HTML content, classified as a UXSS (Universal Cross-Site Scripting) issue. The vulnerability is publicly disclosed but lacks a CVSS score and explicit remediation details in the provided data. The vendor advisory is available but does not explicitly confirm patch status in the input data.

Successful exploitation could allow an attacker to inject arbitrary scripts or HTML into the browser UI, potentially leading to UI spoofing or other low-severity impacts. However, the Chromium security team has assessed this vulnerability as low severity, indicating limited impact or difficulty in exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 149.0.7827.53 or later once available. No additional vendor-provided mitigation instructions are present in the data.