Chrome for iOS contains an input validation flaw that allows untrusted data to be processed without adequate checks. When the browser reads a malicious file, the flaw can trigger a code path that executes attacker-controlled instructions inside a sandbox, giving full control of the browser process. The weakness is a classic example of CWE-20, Improper Input Validation, which compromises confidentiality and integrity and can affect availability of the browser's functions.

All installations of Google Chrome on iOS prior to version 150.0.7871.47 are affected. An earlier build contains the flaw that is present in those builds.

The vulnerability requires the attacker to deliver a malicious file to the target device, limiting the attack to a local, on-device scenario. The CVSS score of 8.8 reflects high severity. A low EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog, implying no evidence of active exploitation at present.