Technical impact
Insufficient policy enforcement in Chrome for iOS allowed a remote attacker to bypass discretionary access control using a crafted HTML page. The flaw permits elevated privileges or unauthorized data access without needing local exploitation. The Chromium severity assessment labels it as low, indicating that the vulnerability’s impact is limited but still present.
Affected Systems
Google Chrome for iOS is affected. No specific version is listed, but the issue applies to releases prior to 149.0.7827.53.
Risk and Exploitability
The EPSS score is less than 1%, indicating a very low likelihood of widespread exploitation. Nevertheless, a remote attacker could supply a malicious HTML page to a victim who opens it in Chrome for iOS, leveraging the policy enforcement weakness to gain unauthorized access or manipulate data. The CVSS score of 4.3 denotes low severity, and the Chromium low severity rating confirms the vulnerability’s impact is limited, but the access control bypass still poses a moderate risk for impacted users who regularly encounter untrusted web content.
Debian DSA