This vulnerability in Google Chrome on Android versions before 149.0.7827.53 arises from improper implementation of policy enforcement in the Page Info component. An attacker who has already compromised the renderer process can exploit this flaw to bypass navigation restrictions by using a specially crafted HTML page. The issue is classified under CWE-284 (Improper Access Control). The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor advisory linked does not explicitly state patch availability or remediation level.

The vulnerability allows an attacker with control over the renderer process to bypass navigation restrictions, potentially leading to unauthorized actions or integrity violations within the browser context. There is no direct confidentiality or availability impact reported. No known exploits in the wild have been identified, which may limit immediate risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.