The flaw is a use after free bug in Chrome's iOSWeb component that allows an attacker to run arbitrary code within the browser sandbox. This vulnerability falls under CWE-416 and CWE-825, indicating that the application prematurely uses freed memory and that attacker-controlled code can be executed after the free operation. If exploited, the compromised code runs with the privileges granted to the browser process, which could facilitate data theft, malware installation, or pivoting to other devices over the network.

Google Chrome for iOS on versions earlier than 156.0.8078.47. Users of any device model running this version are exposed; newer releases contain the fix.

The CVSS score of 8.8 reflects a high severity remote-code-execution risk that can be triggered by visiting a crafted HTML page. The EPSS score indicates a very low probability of exploitation (<1%), but the lack of listing in the CISA KEV catalog suggests no widespread exploitation has been documented yet. The likely attack vector is a maliciously constructed web page opened in the victim’s Chrome browser on iOS, with no pre-conditions beyond the browser’s normal operation.