A crafted HTML page can trick Chrome on iOS into granting privileged access to a page, bypassing the system's access restrictions. This confused deputy flaw allows a remote attacker to elevate privileges and interact with a page that should be inaccessible, potentially exposing sensitive information or allowing further exploitation.

Google Chrome for iOS, versions prior to 155.0.8059.39, including Mobile Chrome on iOS devices.

The vulnerability is classified with a CVSS score of 5.4, indicating low severity, and has an EPSS score of 0.00178, signifying a very low probability of exploitation. It is not listed in the CISA KEV catalog. The attack requires the attacker to host or serve a malicious HTML page that the victim opens in Chrome, thereby achieving remote privilege escalation. As the flaw is not widely reported or actively exploited, the likelihood of exploitation remains uncertain but could increase if the vulnerability were advertised.