An insufficient enforcement of navigation policy in Google Chrome on Android allows a renderer process that has been compromised to navigate the browser to arbitrary URLs through a specially crafted HTML page. The flaw does not provide full remote code execution, but it undermines the sandbox by allowing a malicious renderer to redirect the user to sites that would otherwise be blocked, potentially delivering further attacks or phishing content.

All Android installations of Google Chrome earlier than version 149.0.7827.53 are vulnerable. The issue resides in the navigation handling code within the renderer process of the Chromium engine for mobile devices.

The vulnerability has a CVSS score of 6.5, indicating a medium severity. The EPSS score is < 1%, pointing to a low overall exploitation probability. The vulnerability is not listed in the CISA KEV catalog. A remote adversary must first gain control of the renderer process—typically via a malicious webpage or application—before abusing the navigation policy. Once this foothold is achieved, the attacker can trigger navigation to unrestricted destinations in a way that bypasses the intended restrictions.