Chrome for iOS contains a side‑channel information leakage in the WebAuthentication API. The defect, classified as CWE‑1300, allows a malicious web page to infer cross‑origin data that should be protected by same‑origin policies, enabling a remote disclosure of sensitive information without code execution or elevated privileges.

All iOS devices running Chrome versions older than 150.0.7871.47 are affected. The vulnerability applies to every stable‑channel Chrome release installation at risk until the browser is upgraded.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score of less than 1% shows a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying limited or no known widespread exploitation. Based on the description, the likely attack vector is a remote attacker hosting a crafted web page that exploits the WebAuthentication side‑channel; the compromise remains confined to confidentiality loss of cross‑origin data with no code execution or privilege escalation.