The flaw is an incorrect reference resolution in the passwords handling code of Google Chrome on iOS; a local attacker who has already compromised the renderer process can potentially execute arbitrary code outside the browser sandbox. The vulnerability is a medium‑severity local code‑execution flaw, classified as CWE‑706. The impact means that any code running on the device could gain elevated privileges and modify or exfiltrate data. It is inferred that the attack would require the attacker to inject malicious content that reaches the renderer, or otherwise compromise the renderer process via a local vector.

Google Chrome for iOS versions prior to 155.0.8059.39 are affected. The issue was fixed in the 155.0.8059.39 release and later. Users of earlier stable channel builds should be aware that the flaw exists on those versions.

The CVSS score of 7.4 indicates a medium severity. No EPSS value is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed public exploits. The likely attack vector is local and requires that the renderer process be compromised, which may be achieved through a malicious website or a compromised local application. While the risk to a typical user remains moderate, the potential for arbitrary code execution outside the sandbox warrants immediate remediation once the mitigation is available.