Improper input validation in Chrome Mobile for iOS enables a remote attacker to construct a malicious HTML page that could potentially execute arbitrary code outside the browser sandbox. The flaw represents an input validation weakness that, if exploited, might allow an attacker to take full control of the victim’s device. Chromium classifies the severity as medium.

All versions of Google Chrome for iOS prior to 155.0.8059.39 are affected. This includes every build of the stable channel on iOS devices that predates the 155.0.8059.39 release, making users of these earlier versions vulnerable if they encounter engineered HTML content.

Chromium classifies the vulnerability as medium, though the CVSS score of 9.6 indicates high severity, and no EPSS score is available; it is not listed in the CISA KEV catalog. The likely attack vector is a remote social‑engineering scenario where the victim opens a crafted HTML page. The flaw permits code execution outside the sandbox without needing local credentials, thereby expanding the potential impact. Based on the description, this is inferred from the attacker’s ability to leverage social engineering to deliver the malicious content.