In Chrome for iOS prior to build 151.0.7922.72, an improper implementation permitted a remote attacker to acquire data from a different origin by serving a specially crafted HTML page. The flaw arises from inadequate client authentication, corresponding to CWE‑346, and results in the leakage of confidential information across origin boundaries. This can compromise the confidentiality of user data that should be isolated between web domains.

The affected product is Google Chrome for iOS, a mobile web browser distributed by Google. All installations of Chrome for iOS prior to version 151.0.7922.72 are vulnerable. Users running earlier builds are at risk until they upgrade to a patched version released in the July 2026 stable channel update.

The CVSS score of 4.3 classifies this vulnerability as medium severity, and the EPSS score of < 1 % indicates a very low probability of exploitation in the wild. Although the flaw can be triggered remotely from a malicious web page, there is no requirement for privileged access or local execution. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been leveraged by public exploits but remains a potential threat for targeted attacks.