Technical impact
The CVE describes an inappropriate implementation in Chrome for iOS that permits a remote attacker to carry out UI spoofing through a crafted HTML page. The flaw does not provide code execution or direct data exfiltration, but it deceives users into interacting with a counterfeit interface that appears legitimate, potentially leading to credential disclosure or the execution of unintended user actions. This environment‑specific weakness is aligned with the UI spoofing principle and is identified as CWE‑451.
Affected Systems
Google Chrome on iOS versions prior to 151.0.7922.72 are affected; all earlier releases of the iOS application contain the flaw.
Risk and Exploitability
The CVSS score is 6.5, and the EPSS score is less than 1%, indicating a low probability of exploitation at present. The vulnerability is not listed in CISA KEV. The likely attack vector is remote, requiring the victim to open a malicious web page in Chrome on iOS; no special privileges or additional foothold are necessary. The overall risk is moderate, driven mainly by the ease of crafting a malicious page rather than a high exploitation probability.
Debian DLA
Debian DSA