The vulnerability arises from a missing authorization check in the navigation component of Google Chrome for iOS, allowing a remote attacker to craft a malicious HTML page that tricks the browser into navigating to a privileged page. This bypasses the web origin policy, potentially exposing confidential data or enabling actions normally restricted to the browser's trusted context. The impact is limited only to browsers running the affected iOS versions.

Google Chrome on iOS versions earlier than 155.0.8059.39 are affected. The flaw exists in the navigation logic that does not enforce proper origin checks before rendering privileged pages.

The CVSS score is 7.6 and the EPSS score is < 1%, which indicates a low probability of exploitation. The vulnerability is not listed in CISA KEV. The Chromium security team rates it as medium severity. Because the flaw requires only a crafted HTML page served over the network, the likely attack vector is remote over the web. The impact is limited to browsers running the affected iOS versions, but the ability to bypass origin policy can facilitate further exploitation if combined with other vulnerabilities.