Technical impact
Chrome's DevTools on Android prior to 148.0.7778.96 suffer from insufficient data validation (CWE‑20) and missing authentication for navigation control (CWE‑346), which together allow a remote attacker to bypass navigation restrictions using a crafted HTML page. This flaw permits the browser to navigate to arbitrary URLs without the user’s explicit consent, potentially exposing the user to malicious content. Chromium security has classified the weakness as high severity.
Affected Systems
Google Chrome for Android versions earlier than 148.0.7778.96 are affected. The flaw exists in the stable channel build released before the May 2026 update, so devices running these older Chrome revisions on Android remain vulnerable.
Risk and Exploitability
The CVSS score of 4.3 indicates a low‑severity vulnerability. An attacker can deliver the crafted HTML payload to a user who opens it in Chrome DevTools, enabling the navigation bypass. Exploitation requires the victim to interact with DevTools, so disabling or limiting DevTools usage reduces the attack surface. The EPSS score is <1%, indicating a very low but nonzero likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog, so the likelihood of widespread exploitation remains uncertain, yet the potential impact could still affect user privacy and browsing integrity.
Debian DSA