The flaw lies in the rendering of Chrome’s user interface on iOS, which lets a remote attacker create a malicious HTML page that mimics legitimate browser controls. This misimplementation is classified as CWE‑451, indicating a failure of security controls to prevent unauthorized manipulation of the UI. An attacker could therefore trick a user into mis‑interpreting prompts or interacting with deceptive elements, potentially leading to credential compromise or execution of unwanted actions.

All users running Google Chrome for iOS versions earlier than 151.0.7922.72 are affected. Versions newer than that are not impacted. No other browsers or version families have been reported to be vulnerable.

Chromium rates this issue as Medium with a CVSS score of 6.5. The EPSS score of <1% indicates a low likelihood of widespread exploitation at present. Because exploitation requires the victim to open a crafted page, the vulnerability is most relevant to targeted phishing campaigns rather than mass attacks and it is not listed in the CISA KEV catalog. Updating to the latest Chrome release removes the flaw entirely.