The vulnerability is an authorization bypass in the SignIn component of Google Chrome for iOS, affecting versions prior to 156.0.8078.47. A remote attacker can serve a crafted HTML page that triggers the flaw, allowing the attacker to bypass system access restrictions and gain unauthorized access to user data or perform actions that require a signed‑in state. The flaw is identified as CWE-862.

Google Chrome on iOS, specifically all releases before 156.0.8078.47. Devices running older Chrome versions are at risk until the update is installed.

EPSS score is < 1% and the vulnerability is not in the CISA KEV list. The flaw allows a remote attacker to bypass system access restrictions via a crafted HTML page, enabling unauthorized access to user data and privileged browser actions. The CVSS score of 6.5 indicates medium severity, and the attack vector is remote through a malicious web page. While the immediate impact is denial of authorized access and potential data exposure inside the browser sandbox, the moderate overall risk reflects the low exploitation probability and the lack of a known public exploit.