The vulnerability arises from insufficient validation of untrusted input in the Sharing component of Google Chrome on Android. An attacker can send malicious network traffic that bypasses the browser's navigation restrictions, allowing the browser to navigate or load content without user consent. This is a CWE‑1286 authentication‑bypass weakness, enabling the attacker to drive the browser to potentially phishing or deceptive pages, but it does not provide broader code execution or persistence.

Affected systems include all users of Google Chrome on Android devices running versions earlier than 151.0.7922.72. The defect is present in the Chrome browser shipped by Google and any product variants that include the default Sharing feature. All Android installations of Chrome that have not received the July 2026 stable channel update are susceptible.

The CVSS score of 4.3 and an EPSS score below 1% indicate a low probability of exploitation under current threat conditions, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, through crafted network traffic to a target device while the vulnerable browser is active. The impact remains confined to unauthorized navigation, not allowing code execution or system compromise.