A vulnerability in Google Chrome on Android prior to version 148.0.7778.96 involves insufficient validation of untrusted input in the Payments component. This flaw allows a remote attacker who has compromised the renderer process to spoof the Omnibox (URL bar) contents via a crafted HTML page. The issue has a medium severity rating and a CVSS score of 4.2.