The flaw is an insufficient policy enforcement in Google Chrome for iOS that permits a remote attacker to bypass discretionary access control by loading a specifically crafted HTML page. The vulnerability allows an attacker to access or manipulate resources protected by the browser’s access controls without authorization, potentially exposing sensitive data or enabling further malicious activity. The Chromium severity is classified as Low, indicating the impact is limited but noteworthy for users who may encounter malicious content.

Google Chrome for iOS versions prior to 149.0.7827.53 are affected. The issue is limited to the iOS platform and does not impact other operating systems or desktop Chrome builds.

The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of exploitation in the wild. Attackers would need to entice the user to load the malicious HTML via a web page, email, or other content delivery mechanism, making social engineering a likely prerequisite. Because the CVSS score is 4.3 and the vulnerability is device‑specific, the overall risk is considered limited but warrants updating to the patched release.