Chrome Mobile contains a race condition that lets a remote attacker craft an HTML page causing the browser to bypass the same‑origin policy. The vulnerability is a classic concurrency flaw (CWE‑367), which allows the attacker to access or execute code across web origins that would normally be restricted, potentially exposing or modifying sensitive data in the victim’s browser context.

All users running Google Chrome on iOS prior to version 157.0.8103.38 are affected. The issue exists only in the Mobile build and does not impact desktop or Android editions.

The EPSS score is not available, so the likelihood of exploitation is not quantifiable, and the vulnerability is not listed in CISA’s KEV catalog. Chromium classifies it as Low severity, indicating that while it allows cross‑origin access, it requires a crafted web page delivered to the user, and no public exploit is known. Attackers would need to lure the target to view a malicious page that triggers the race condition; the absence of a public exploit and modest severity suggest a lower but still non‑trivial risk.