Information disclosure was identified in the navigation component of Google Chrome for iOS. An attacker can provide a crafted HTML page that, through social engineering, triggers the browser to leak sensitive data. The flaw falls under the information disclosure weakness category (CWE-200).

The issue affects Google Chrome running on iOS devices and covers all releases prior to version 156.0.8078.47. Users of those versions should upgrade to the latest stable channel build, which contains the fix.

With a CVSS score of 8.8, the vulnerability is considered high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog, but the nature of the flaw—information disclosure via crafted web content—suggests that exploitation is likely feasible for attackers who can drive a victim’s browser to a malicious HTML page. The required input is a user‑viewed page, so social engineering or phishing may be needed to reach a target. If an attacker succeeds, the leaked information could include browsing session data or other sensitive data exposed by the navigation component.