Improper input validation in Google Chrome Mobile for iOS versions earlier than 155.0.8059.39 allows a remote attacker, by social engineering a co‑installed application, to bypass the browser’s web origin policy. The flaw can enable the malicious app to read or write data from other origins within the victim’s Chrome process, potentially leaking sensitive information or causing unintended actions. The weakness is an Input Validation issue (CWE-20).

Google Chrome for iOS on any device running a version prior to 155.0.8059.39 is affected. The problem exists in the Mobile implementation of Chrome’s web origin policy enforcement. No other vendors or products are reported to be impacted.

The CVE has a Chromium‑specified Low severity and a published CVSS score of 6.5. The EPSS score is < 1%, indicating a very low probability of exploitation. The attack requires the user to install a helper application that can interact with Chrome, so the vector is local/social engineering rather than remote code execution over the network. With the vulnerability present, an attacker could gain a simplified cross‑origin capability in the victim’s browser session, but they must rely on the victim running an untrusted co‑installed app. Because the flaw is not remotely injectable, the risk to a broad user base is limited unless the malicious app gains widespread adoption.