UI misrepresentation in the Navigation component of Google Chrome on iOS prior to 156.0.8078.47 allows a remote attacker to spoof the address bar through a crafted HTML page, leveraging social engineering to deceive users into believing they are on a trusted site. This can lead to credential or sensitive information disclosure. The weakness is classified as CWE‑451.

Google Chrome on iOS, specifically versions earlier than 156.0.8078.47.

The CVSS score of 8.8 indicates a high severity vulnerability, but the EPSS score of < 1% suggests a low exploitation probability. The flaw is not listed in the CISA KEV catalog, yet the high CVSS remains a concern. The attack vector is remote; a malicious web page can be served by an attacker and, by exploiting the UI misrepresentation, trick the user into interacting with the spoofed address bar. Successful exploitation would lead primarily to phishing or credential compromise rather than code execution or catastrophic crash.