An improper input validation logic in the Signin module of Google Chrome for iOS allows a remote attacker to serve a malicious HTML page that can mimic the sign‑in user interface. Leveraging this flaw, an attacker could trick a user into entering credentials or other sensitive data into a spoofed form. The primary impact is phishing—no arbitrary code execution or data disclosure, but credential theft or unwanted actions if the user complies.

Versioned Chrome for iOS browsers older than 149.0.7827.53 are vulnerable. The flaw exists in all builds of Chrome on iOS with earlier revision numbers, affecting mobile devices running those builds.

The CVSS score is low, and EPSS data is not available, but the flaw is remotely exploitable through a crafted webpage. Although the attack requires social engineering to lure a user to the malicious page, the lack of code execution limits the damage to credential theft or unintended interactions, yet the presence of a known Chrome update mitigates the risk. The vulnerability is not yet listed in CISA’s KEV catalog.