An inappropriate implementation in Chrome for iOS allows a remote attacker to bypass navigation restrictions by loading a crafted HTML page. The attacker can cause the browser to navigate to arbitrary URLs that are normally blocked, which could be used to direct users to phishing or malicious sites and compromise user security. The weakness resides in the handling of navigation requests, classifying it as an access control flaw.

Google Chrome on iOS version 151.0.7922.72 and earlier are impacted. The vulnerability affects all users who have not updated to at least the 151.0.7922.72 release. No specific device models are excluded, so all iOS devices that run Chrome before that build are vulnerable.

The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a very low probability of exploitation. The CVSS score of 4.3 indicates low severity. The attack requires a user to load a specially crafted web page on a compromised device, making the attack vector primarily user‑initiated. While widespread exploitation is unlikely, organizations with stringent security requirements should consider the risk of malicious pages reaching users and enabling navigation to unrestricted sites.