An incorrect security UI in Google Chrome for iOS < 151.0.7922.72 permits a remote attacker to craft a malicious web page that, when opened in the browser, displays a forged Omnibox (URL bar) that does not reflect the actual site being loaded. This UI spoofing can mislead users into believing they are interacting with a legitimate domain, enabling phishing, credential theft, or other social‑engineering attacks. The flaw involves an oversight in rendering the Omnibox security indicators and is classified as CWE‑451.

Apple iOS devices running Google Chrome versions older than 151.0.7922.72 are impacted. The vulnerability is present in all builds of the Chrome for iOS browser released prior to that patch level, regardless of region or user configuration.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1 % and absence from the CISA KEV catalog suggest a low probability of exploitation. An attacker must construct a tailored HTML page and persuade a user to open it in Chrome on iOS. No system privileges are required, and the flaw does not compromise the underlying operating system or other applications. The primary risk is the potential for credential compromise through phishing once the UI spoof is displayed.