This vulnerability in Google Chrome on Android (before version 151.0.7922.72) is due to insufficient validation of untrusted input. A local attacker could exploit this flaw by using a malicious file to spoof the Omnibox (URL bar) contents, potentially misleading users about the website they are visiting. The CVSS score is 3.3 with an attack vector of local, low attack complexity, no privileges required, user interaction required, and impact limited to integrity. No known exploits in the wild have been reported. The vendor advisory link is provided but does not explicitly confirm patch status or remediation details.

The impact is limited to integrity, specifically allowing an attacker to spoof the URL bar contents on affected Chrome versions on Android. There is no impact on confidentiality or availability. This could potentially be used to deceive users about the legitimacy of a website, but exploitation requires local access and user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update to version 151.0.7922.72 or later once confirmed. Until then, avoid opening untrusted files locally on affected devices to reduce risk.