Google Chrome for Android Untrusted Input Validation Vulnerability Allowing Universal Cross-Site Scripting

A vulnerability in Google Chrome on Android, prior to version 148.0.7778.96, allows local attackers to inject arbitrary scripts or HTML, leading to universal cross-site scripting (UXSS) via a crafted Chrome extension. This issue arises from insufficient validation of untrusted input in the mobile version of the browser.

Impact

Exploitation of this vulnerability allows for universal cross-site scripting, where injected scripts can be executed in the context of the user, potentially leading to session hijacking or other malicious actions.

Remediation

Users can update to Google Chrome version 148.0.7778.96 or later to address this vulnerability.