Insufficient policy enforcement in Chrome for iOS allows a remote attacker to bypass discretionary access control through a crafted HTML page. The flaw permits unauthorized access to resources that should be protected, effectively elevating privileges. CWE‑284 indicates an improper control of resource permissions governing data access. The impact is the potential for an attacker to read or modify data that should only be available to the legitimate user.

Google Chrome for iOS versions prior to 151.0.7922.72 are affected.

The CVSS score of 6.5 classifies the vulnerability as medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation. The issue is not listed in the CISA KEV catalog. The likely attack vector is a malicious webpage delivered to a user’s iOS device, where the attacker exploits the insufficient policy enforcement to bypass discretionary access control. Given the low EPSS and absence of known attacks, the overall risk is low, but the potential for unauthorized data disclosure remains.