This vulnerability in Google Chrome's Omnibox component allows insufficient validation of untrusted input, leading to potential cross-site scripting (UXSS) attacks. An attacker who convinces a user to perform certain UI gestures on a maliciously crafted HTML page can inject arbitrary scripts or HTML. The issue affects versions prior to 149.0.7827.53. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. The vendor advisory linked does not explicitly state if a fix is available or if users must take action.

Successful exploitation could allow an attacker to execute arbitrary scripts or HTML in the context of the affected browser, potentially leading to information disclosure or manipulation of browser content. The impact is rated medium with limited confidentiality and integrity impact and no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation of a fix is available, users should exercise caution with untrusted web content and avoid performing unusual UI gestures on suspicious pages. No specific vendor-provided mitigations are documented.