An implementation flaw in Chrome for iOS allows a remote attacker to bypass the browser’s navigation restrictions by serving a specially crafted HTML page. When such a page is loaded, the built‑in navigation guard is circumvented, enabling the browser to follow arbitrary URLs that would normally be blocked. The vulnerability is identified as CWE‑284, Improper Access Control, and can be exploited to silently redirect users to malicious sites or load unauthorized content. The impact is limited to navigation control, but it can be leveraged in targeted phishing or social engineering campaigns.

Google Chrome for iOS versions prior to 151.0.7922.72 are affected. Any device running an older build of Chrome on iOS, regardless of the underlying iOS version, is at risk because the flaw resides in Chrome’s navigation handling code.

The CVSS score of 4.3 classifies the issue as low severity, and the EPSS score of less than 1 % indicates a very small probability of exploitation. The flaw is triggered by visiting a crafted page in Chrome on iOS, so the attack vector is remote and requires user interaction. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread active exploitation. Nonetheless, a determined attacker could use the bypass to facilitate targeted phishing attacks or to load disallowed content that may lead to further compromise.