The vulnerability is a UI misrepresentation flaw in the passwords field of Google Chrome on iOS, affecting versions prior to 157.0.8103.38. A remote attacker can create a crafted HTML page that spoofs UI elements, tricking users into believing they are entering credentials into a legitimate password prompt. This flaw can be exploited through social engineering to harvest sensitive login information. Chromium rates the issue as medium severity.

Google Chrome for iOS versions before 157.0.8103.38.

EPSS score is not available and the flaw is not listed in CISA's KEV catalog. The attack vector is straightforward – any web page containing the crafted HTML can be used by an attacker. The flaw does not provide privilege escalation or remote code execution, but its primary risk lies in credential theft via phishing. While no public exploits have been documented, the potential for widespread social engineering attacks makes it a significant threat for sensitive accounts, warranting prompt remediation.