The vulnerability allows a remote attacker to spoof user interface elements in the PageInfo pane of Google Chrome on iOS by serving a specially crafted HTML page. The attack does not grant code execution or privilege escalation but can mislead users into believing they are interacting with legitimate Chrome UI components, potentially enabling phishing or social‑engineering attacks. The weakness is a failure to validate preconditions before rendering UI elements, identified as CWE‑451.

Google Chrome for iOS versions earlier than 157.0.8103.38 are affected. The issue occurs on the iOS platform and does not impact desktop or Android builds of Chrome.

The vulnerability can be exploited remotely by simply loading a crafted web page into the browser; no privileged access or additional configuration is required. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, reflecting a moderate likelihood of exploitation at present. The CVSS indicates a medium severity for this UI spoofing flaw. Attackers can target any user who visits a malicious site that contains the crafted PageInfo payload, making the threat relevant for all users running the vulnerable Chrome version.