The vulnerable condition is an inappropriate implementation in the Session component of Google Chrome for Android that allows a remote attacker to bypass the browser’s navigation restrictions when a crafted HTML page is loaded. This flaw is an access control weakness, reported as CWE‑284, and can enable an attacker to redirect the user to unintended destinations without the user’s consent, thereby compromising the integrity of the browsing experience.

All Android installations of Google Chrome prior to version 151.0.7922.72 are affected. These versions lack the fix that enforces navigation restrictions, making them vulnerable until the browser is updated.

The CVSS score of 4.3 places the issue in the low‑risk category, and the EPSS score of less than 1 % indicates that exploitation attempts are unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector is a remote attacker serving a crafted HTML page that a user opens in Chrome, such as through a malicious website. No local privileges or additional conditions are required beyond visiting the malicious content.