An incorrect security UI in Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to spoof the contents of the Omnibox through a specially crafted HTML page. This vulnerability, identified as CWE-451, could mislead users into believing they are viewing a different webpage. Based on the description, it is inferred that the falsified URL display may deceive users into interacting with malicious sites. The official Chromium severity is low, but the UI spoofing raises concerns about user deception.

Affected systems include Google Chrome for iOS users running any build earlier than version 150.0.7871.47. The vulnerability applies to all iOS devices that install the app with the impacted browser build.

The CVSS score of 4.3 classifies the vulnerability as low severity, and the EPSS score of less than 1% indicates a very low exploitation probability at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a malicious website that serves a crafted HTML page rendered in Chrome iOS, which reveals the spoofed Omnibox and potentially deceives the user. While exploitation requires only that a user visit the malicious page, the overall risk to individuals hinges on the user’s susceptibility to the deceptive UI.