The vulnerability is a UI misrepresentation flaw in Chrome for iOS prior to build 156.0.8078.47 that allows a remote attacker to spoof UI elements by serving a crafted HTML page. This flaw, which falls under the weaknesses CWE‑451 and CWE‑825, can deceive users into interacting with altered interface components, potentially leading to social‑engineering or credential‑harvesting attacks (inferred from the nature of UI spoofing). The impact is limited to the browsing session and does not provide code execution but can manipulate the user experience to facilitate phishing or other UI‑based attacks (inferred).

Affected browsers are Google Chrome installations on iOS that are running any version before 156.0.8078.47. The issue affects all iOS devices with the vulnerable Chrome build. Devices running the updated version 156.0.8078.47 or later are not susceptible.

The CVSS score of 8.8 indicates a high severity, while the EPSS score of less than 1% reflects a low current exploitation probability and it is not listed in the CISA KEV catalog. The vulnerability can be exploited remotely simply by directing a user to a crafted HTML page in Chrome for iOS. The attacker does not gain code execution or system privileges; rather, they can alter the visual representation of UI elements to mislead the user into performing actions such as entering credentials. The flaw requires a user to visit the malicious page, making it a social‑engineering vector that relies on user interaction and browser rendering.