Insufficient data validation in DevTools of Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker to bypass navigation restrictions via a crafted HTML page. This flaw permits the browser to navigate to arbitrary URLs without the user’s explicit consent, potentially exposing the user to malicious content. Chromium security has classified the weakness as high severity.

Google Chrome for Android versions earlier than 148.0.7778.96 are affected. The flaw exists in the stable channel build released before the May 2026 update, so devices running these older Chrome revisions on Android remain vulnerable.

The CVSS score of 4.3 indicates a low‑severity vulnerability. An attacker can deliver the crafted HTML payload to a user who opens it in Chrome DevTools, enabling the navigation bypass. Exploitation requires the victim to interact with DevTools, so disabling or limiting DevTools usage reduces the attack surface. The EPSS value is not publicly available and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of widespread exploitation remains uncertain, yet the potential impact could still affect user privacy and browsing integrity.