The vulnerability involves insufficient validation of untrusted input in the TabSwitcher component of Google Chrome on Android. A remote attacker who can send crafted network traffic to the device may cause the browser to bypass its URLs to be loaded a CWE‑20 weakness. The impact is limited to the ability to override navigation controls and does not provide remote code execution or other higher‑level privilege escalation.

Chrome on Android versions earlier than 150.0.7871.47 are affected. Users should confirm that their browser is at least this version or newer to avoid the issue.

With a CVSS score of 4.3 and an EPSS probability of less than 1%, the vulnerability is classified as low severity and is not listed in the CISA KEV catalog. Exploitation requires the attacker to deliver malicious network traffic to the victim’s device, for example through a compromised local Wi‑Fi network or a malicious access point. While the risk is low, the ability to bypass navigation safeguards could be used by adversaries who already have network access to a target device.