A side‑channel information leak in WebAuthentication allows a remote attacker to extract cross‑origin data by hosting a crafted HTML page. Chromium rates the severity as Medium. The flaw enables unauthorized disclosure of sensitive information without triggering traditional authentication failures.

Google Chrome on iOS versions earlier than 150.0.7871.47 are vulnerable. Later releases contain the fix.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so known exploitation rates are unknown. Based on the description, the likely attack vector is remote delivery of malicious web content that the user visits, leading to data exfiltration. The impact is limited to information disclosure on the victim device, but it is exploitable by any actor that can host a malicious site.