Google Chrome for Android contains insufficient validation of untrusted input during Tab Group synchronization. A remote attacker can spoof sync traffic to inject arbitrary scripts or HTML, leading to cross‑site scripting that runs in the context of the user’s browser. This is a classic input‑validation flaw (CWE‑20) that can compromise the confidentiality, integrity, and availability of the user’s browsing session.

The flaw affects all Chrome for Android installations that have the Tab Group sync feature enabled and whose version is earlier than 149.0.7827.53. Devices running any older Android Chrome releases are vulnerable until a patch is applied.

The vulnerability has a Chromium severity of Medium and no EPSS score is recorded. It is not listed in CISA’s KEV catalog. Exploitation requires the attacker to interfere with the sync traffic, which can be achieved over unsecured or compromised networks. Once a malicious payload is injected, the user’s browser executes it immediately, without needing additional user interaction, making the attack path relatively direct.