Chrome for iOS versions older than 151.0.7922.72 contain an insufficient input validation flaw that lets a malicious actor inject arbitrary scripts or HTML into the browser via network traffic. This flaw can be used to execute code in the context of a user’s browsing session, potentially enabling malicious actions that compromise the integrity of the user experience.

The affected product is Google Chrome on iOS devices running any release prior to 151.0.7922.72. No other vendors or products are mentioned in the advisory.

The EPSS score of less than 1% indicates a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote through malicious network traffic that reaches the browser. The CVSS score of 5.4 describes medium severity.