This vulnerability involves insufficient validation of untrusted input in the mobile version of Google Chrome on Android. Specifically, it allows a local attacker to craft a malicious file that can spoof the Omnibox contents, potentially deceiving users about the true destination URL. The affected version is prior to 151.0.7922.72. The vulnerability was publicly disclosed with no CVSS score assigned and no explicit remediation level stated in the advisory. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation status.

A local attacker can exploit this vulnerability to spoof the URL displayed in the Omnibox, potentially tricking users into believing they are visiting a legitimate site when they are not. This can facilitate phishing or social engineering attacks. There is no indication of remote exploitation or broader system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update Google Chrome on Android to version 151.0.7922.72 or later once confirmed. Until then, exercise caution when opening files from untrusted sources locally on affected versions.