This vulnerability arises from insufficient validation of untrusted input within the DevTools component of Google Chrome on Android. Specifically, it allows a local attacker to bypass navigation restrictions by leveraging a malicious file, potentially causing integrity violations. The issue is tracked as CWE-602 (Improper Restriction of XML External Entity Reference). The CVSS 3.1 base score is 5.5, reflecting a medium severity with local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vulnerability affects Chrome versions prior to 150.0.7871.47 on Android. The vendor advisory linked does not explicitly state patch availability or remediation level, so patch status is not yet confirmed and should be verified with the vendor advisory.

The vulnerability allows a local attacker to bypass navigation restrictions in Chrome DevTools on Android, potentially leading to unauthorized actions that affect the integrity of the browser environment. There is no impact on confidentiality or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to Chrome version 150.0.7871.47 or later once confirmed. Until then, avoid opening untrusted files in DevTools on affected versions.