An inappropriate implementation in Chrome for iOS versions prior to 149.0.7827.53 allows a remote attacker to construct a crafted HTML page that mimics legitimate UI elements. The affected browser renders the page in a manner that can deceive users into believing it is part of the genuine application interface, potentially leading to credential disclosure or other malicious actions performed by the user without their knowledge.

The vulnerability impacts Google Chrome on iOS devices running any version before the 149.0.7827.53 update. No specific sub‑revision list is supplied, but all builds older than the mentioned release are susceptible. The attack surface is limited to the Chrome iOS app and does not affect other Google or non‑Google browsers on iOS.

The CVE is classified with a low severity rating and is not listed in the CISA KEV catalog; an EPSS score is not available. The exploit requires the victim to visit a maliciously constructed web page, meaning the attack is remote and does not require local escalation. Because the issue is confined to UI deception rather than code execution, the direct exploitation risk is modest, but the potential for phishing and credential compromise remains a concern as the malicious page is presented within a trusted browser environment.