Google Chrome for iOS versions prior to 155.0.8059.39 contains an incorrect authorization flaw in the Passwords module that allows a remote attacker to craft a malicious HTML page. When the page is opened in the affected Chrome browser, the attacker can bypass the browser’s web origin policy, potentially reading or manipulating saved password information or accessing other privileged browser resources. The primary impact is unauthorized data access that could lead to credential theft or further exploitation within the browser sandbox.

The vulnerability impacts all iOS users running Chrome versions older than 155.0.8059.39. Until the fix is applied, any device with a newer version is not affected.

Chromium labels the issue as Medium severity; the EPSS score is < 1% and it is not listed in the CISA KEV catalog. The attack vector is remote: an attacker only needs to get a victim to open a specially crafted page in iOS. No additional privileges or local access are required, making exploitation relatively straightforward for a web-based threat actor.