A missing authorization check in Mobile Google Chrome for iOS allows a remote attacker to embed malicious HTML that mimics legitimate UI elements. Classified as CWE‑862, this flaw lets the attacker trick users into interacting with counterfeit input fields or buttons, potentially leading to credential theft or other social‑engineering attacks. The vulnerability does not provide code execution or arbitrary system access, but it undermines user trust and can compromise data entered through the spoofed interface.

Google Chrome for iOS, versions earlier than 155.0.8059.39. No additional sub‑products are identified in the CNA data.

Chromium lists the vulnerability severity as Medium with a CVSS score of 5.4. No EPSS score is available, and the issue is not listed in the CISA KEV catalog. Exploitation requires a vulnerable device to open a crafted page; the attacker must rely on social engineering to convince the user to interact with the spoofed UI components. While the flaw does not enable direct code execution, the deceptive interface can lead to the compromise of credentials or other sensitive information.