This vulnerability arises from insufficient data validation in the DevTools feature of Google Chrome on Android versions before 148.0.7778.96. An attacker can craft a malicious HTML page that bypasses navigation restrictions, potentially leading to limited unauthorized data disclosure. The CVSS score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. No official patch or remediation level is explicitly stated in the vendor advisory provided, and no known exploits have been reported.

The impact is limited to partial confidentiality loss due to bypassing navigation restrictions in DevTools on affected Chrome Android versions. There is no impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted HTML content in Chrome DevTools on Android. No additional vendor-recommended mitigations are currently documented.