This vulnerability in Google Chrome on Android arises from insufficient validation of untrusted input within the TabSwitcher feature. It enables remote attackers to bypass navigation restrictions by leveraging malicious network traffic. The issue is identified as CWE-20 (Improper Input Validation). The affected versions are those before 150.0.7871.47. The CVSS v3.1 score is 4.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only. The vendor advisory linked does not explicitly state the patch or fix status, so patch availability is not confirmed.

The vulnerability allows remote attackers to bypass navigation restrictions in Chrome on Android, potentially leading to unauthorized navigation actions. The impact is limited to integrity with no confidentiality or availability effects reported. There are no known exploits in the wild, and the severity is rated medium.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed patched. Until then, exercise caution with untrusted network content and monitor for updates from Google.