The vulnerability is an improper input validation in the Navigation component of Google Chrome for iOS. When a user visits a specially crafted HTML page, the browser can trigger a use‑after‑free. If the attacker has compromised the renderer process, the flaw may allow execution of arbitrary code outside the sandbox; based on the description, it is inferred that this could potentially give the attacker full control over the device through the browser context.

Google Chrome for iOS versions earlier than 156.0.8078.47 are affected. The issue exists on all iOS devices that run the listed versions of Chrome.

The CVSS score of 8.8 indicates high severity. The EPSS score is < 1%, indicating a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. A remote attacker who can serve a malicious web page can trigger the flaw; if the renderer process is compromised, the attacker could execute code outside the iOS sandbox; based on the description, it is inferred that this could yield full device control. The attack vector remains external remote, requiring the victim to open the crafted page to exploit the use‑after‑free.