Technical impact
This vulnerability involves the representation of the sign‑in interface on Google Chrome for iOS. A malicious web page can cause Chrome to display spoofed UI elements that appear to be legitimate sign‑in prompts. The attack could lead an unsuspecting user to enter credentials on a counterfeit interface, resulting in credential compromise or phishing. The weakness corresponds to improper handling of dynamic UI rendering (CWE-451) and unvalidated input that can inject UI elements (CWE-1021).
Affected Systems
Affected product is Google Chrome for iOS, with all releases prior to version 154.0.8037.92 impacted. The vulnerability is limited to iOS devices running the affected Chrome build.
Risk and Exploitability
The likely attack vector is a remote attacker hosting a crafted HTML page that the victim opens in the affected Chrome browser. The CVSS score of 5.4 places the vulnerability in the low to moderate severity band. An EPSS score of < 1% indicates a low likelihood of exploitation, and the vulnerability is not currently listed in the CISA KEV catalog. Successful exploitation results in credential theft through deceptive UI, but does not grant direct code execution or system compromise. The flaw involves both CWE-451 and CWE-1021, indicating potential for UI injection and unvalidated rendering.
Debian DLA
Debian DSA