This vulnerability in Google Chrome on Android arises from insufficient validation of untrusted input within the Payments feature. An attacker who has already compromised the renderer process can exploit this flaw to conduct UI spoofing attacks by crafting malicious HTML pages. The issue is tracked as CVE-2026-17747 with a medium severity rating and a CVSS score of 4.2. The affected versions are those prior to 151.0.7922.72. The vendor advisory linked does not explicitly confirm a patch or remediation status as of the publication date.

The vulnerability allows a remote attacker with control over the renderer process to perform UI spoofing, potentially misleading users by displaying deceptive user interface elements. The confidentiality impact is low, integrity impact is none, and availability impact is low according to the CVSS vector. There are no known exploits in the wild, reducing immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users and administrators should monitor the official Google Chrome release notes and update to version 151.0.7922.72 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.