A race condition in Chrome for iOS allows a remote attacker to spoof UI elements via a crafted HTML page, causing the browser’s interface to display incorrect elements. This flaw can lead to phishing attacks or the execution of unintended actions without user awareness. The vulnerability is rated Medium in Chromium’s internal severity scale and is categorized as CWE‑367, representing a race condition whereby timing differences can be exploited by an attacker. The impact is that users may be deceived into providing sensitive information or interacting with the browser in ways that could compromise confidentiality and integrity.

Google Chrome for iOS versions prior to 156.0.8078.47 are affected. Users on any iOS device running a version of Chrome older than the specified patch are vulnerable.

The CVSS score for this vulnerability is 6.5, but the Chromium severity is Medium, indicating a modest expected impact. Exploitation requires a crafted HTML page served from a remote site and the victim must open that page on a compromised device. The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation, and the vulnerability is not presently tracked in CISA’s KEV catalog, suggesting no known ongoing exploitation but still a meaningful risk for highly targeted attacks. Given the attack vector and moderate severity, the risk is adequate for urgent remediation rather than monitoring alone.