The vulnerability originates from an improper implementation in Chrome for iOS, where a crafted HTML page can trigger a sandbox escape. The flaw enables a remote attacker to cross the browser sandbox boundary, potentially executing code with higher privileges than intended and compromising the confidentiality, integrity, or availability of the device. The weakness is a classic input validation/escaping issue classified as CWE‑20.

Affected vendor is Google, product Chrome for iOS, version prior to 149.0.7827.53. All Chrome for iOS releases earlier than that patch are vulnerable.

The flaw can be exploited remotely by delivering a crafted HTML page to the user, and the attack vector is a remote web-based vector. Although the EPSS score is < 1% and the CVE is not listed in the CISA KEV catalog, the high severity designation—reflected in a CVSS score of 8.8—indicates that the exploit is feasible with moderate effort. The low EPSS score suggests that large-scale exploitation is unlikely at present, yet the potential impact of sandbox escape warrants significant attention.