A race condition in Google Chrome for iOS before version 151.0.7922.72 can allow a remote attacker to craft an HTML page that triggers UI spoofing. The attacker can cause visible UI elements to appear misleading, potentially tricking users into interacting with malicious content. Although the bug does not grant code execution, the resulting deceptive interface can be used for phishing or other fraud vehicles. Based on the description, the attack vector appears to be a web‑based exploit rather than a local code execution pathway.

The affected product is Google Chrome for iOS. Devices running Chrome on iOS with a build number older than 151.0.7922.72 are vulnerable. No other vendors or product variants are listed.

The EPSS score is below 1 %, indicating a low probability of exploitation, but the Chromium severity is marked as Medium. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Without a public exploit, the risk remains moderate, yet the potential for malicious UI redirection could still impact user confidentiality and luring them into fraudulent actions if attackers gain an audience. Attackers would need to serve a crafted HTML page to the target device, making the vector remote via the web.