Chrome for iOS suffered from insufficient validation of untrusted input, allowing a remote attacker who convinced a user to perform specific UI gestures to inject arbitrary scripts or HTML through a crafted QR code. This flaw qualifies as an input validation weakness (CWE‑20) and enables the attacker to execute code within the context of Chrome, potentially compromising user data, executing malicious actions, or redirecting to malicious sites. The vulnerability permits the attacker to alter the browser’s execution of scripts, thereby gaining the ability to run arbitrary code or perform privileged interactions within the user’s session.

The issue affects all instances of Google Chrome for iOS running versions prior to 149.0.7827.53. Users with earlier releases are exposed to the described exploit. No other Chrome variants or platforms are listed as affected.

The EPSS score of <1% indicates a low likelihood of exploitation, and the CVSS score of 6.1 classifies the vulnerability as Medium severity. Exploitation requires social engineering to convince the user to interact with a malicious QR code, which implies a moderate to high effort and user interaction prerequisite. If successfully exploited, the attacker can inject scripts that execute with the privileges of the Chrome process, allowing significant compromise of confidentiality, integrity, and potentially availability of the user’s browsing experience.