A remote attacker can exploit an issue in Google Chrome for iOS to bypass the browser’s web origin policy by sending specially crafted network traffic. The flaw results from incorrect provisioning of a specified functionality on mobile devices, allowing the attacker to circumvent same‑origin restrictions that normally prevent cross‑origin data access. This can lead to the extraction of sensitive information from untrusted sites or the execution of unauthorized scripts in a trusted context.

The vulnerability affects Chrome for iOS Mobile versions earlier than 155.0.8059.39. Users running any release before this build are potentially susceptible unless mitigated by a later upgrade.

The issue is rated as Medium in Chromium’s security severity, and the CVSS score of 6.5 indicates this level. No known public exploits or CISA KEV listing are documented. The EPSS score is < 1%, meaning the likelihood of exploitation is very low. The attack requires social engineering to lure a user into receiving crafted network traffic, implying that spear‑phishing or malicious network configuration could be used as initial footholds. Given the lack of public exploitation data, the risk is considered moderate but should be addressed promptly.