An inadequate implementation in Page Info in Google Chrome for Android allows a remote attacker who has already compromised the renderer process to bypass navigation restrictions by delivering a crafted HTML page. The flaw does not grant arbitrary code execution but permits the attacker to redirect or open URLs the user should not be able to access, potentially facilitating phishing or other deceptive interactions. The impact is largely limited to the compromised renderer’s context and does not directly expose the operating system or other processes.

Google Chrome on Android versions prior to 149.0.7827.53 are affected. The vulnerability is present on the Android stable channel and any device running a Chrome installation older than the specified version. No other vendors or product variants are listed.

The CVE carries a Chromium security severity of Low, and there is no EPSS score available or listing in the CISA KEV catalog. Exploitation requires the attacker to first compromise the renderer process, which typically demands a local or privilege escalation vulnerability or an elevated app. Because of that prerequisite, the attack vector is limited and the likelihood of successful exploitation in the wild remains low. Nonetheless, the presence of this weakness underscores the importance of keeping browsers patched and correctly sandboxed.