Missing authorization in Google Chrome for iOS prior to version 156.0.8078.47 permits an attacker to execute arbitrary code through a crafted HTML page. The flaw allows bypass of system access restrictions, giving the attacker the ability to reach protected resources or manipulate the browser context. The potential impact includes unauthorized data access and possible further exploitation of the device.

Google Chrome for iOS versions earlier than 156.0.8078.47 on Apple iPhone operating systems are vulnerable, affecting all iOS devices that use these release lines.

The CVSS score of 8.8 classifies this vulnerability as high severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via a crafted web page that a victim must load in Chrome; hence an attacker would need to lure a user to visit a malicious site or click a malicious link to trigger exploitation.