An insufficient validation of untrusted input in Google Chrome for iOS prior to version 150.0.7871.47 allows a maliciously crafted HTML page to bypass browser sandbox controls. This input‑validation weakness (CWE-20) enables a potential sandbox escape, providing the attacker with the opportunity, integrity, and availability.

Google Chrome for iOS versions before 150.0.7871.47 are affected. Devices running these builds, across any compatible iOS version, are susceptible to exploitation until a newer build is installed.

The CVSS score of 9.6 indicates a highly severe vulnerability, while the EPSS score of less than 1% suggests a low probability of active exploitation currently. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must already have compromised the renderer process, typically through phishing or another vulnerability that grants code execution. The likely attack vector involves delivering a malicious HTML page to the compromised renderer, which may then escape the sandbox and execute arbitrary code. The need for a pre‑existing renderer compromise limits the attack surface but still presents a significant risk to users of the affected builds.