This vulnerability in Google Chrome on Android arises from insufficient validation of untrusted input within the mobile browser's renderer process. An attacker who has already compromised the renderer process can exploit this flaw to spoof the Omnibox contents, potentially misleading users about the actual URL they are visiting. The issue affects versions prior to 151.0.7922.72. The CVSS v3.1 base score is 4.3 (medium), reflecting a network attack vector with low complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No known exploits in the wild have been reported. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

The vulnerability allows an attacker with control over the renderer process to spoof the URL bar in Chrome on Android, potentially misleading users about the legitimacy of the website they are visiting. This could facilitate phishing or social engineering attacks. There is no direct impact on confidentiality or availability. The integrity impact is limited to the spoofing of the Omnibox content.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should update Google Chrome on Android to version 151.0.7922.72 or later once confirmed. Until then, be cautious of suspicious web content and avoid interacting with untrusted sites that might exploit this vulnerability.