In Chrome for iOS, an implementation flaw in versions prior to 151.0.7922.72 allows an attacker who has physical access to the device to read data from the browser’s process memory. This results in the disclosure of potentially sensitive information, classified as an information‑disclosure weakness (CWE‑200). The leak could expose any data residing in memory at the time, thereby compromising user privacy.

Any installation of Google Chrome on iOS that predates release 151.0.7922.72 is vulnerable. Users whose devices run an older version are at risk if the device is physically accessed by an attacker.

The CVSS base score of 2.4 indicates low overall severity, and the EPSS score of less than 1% shows a very low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting limited exploit activity. Exploitation requires local physical access, making the attack vector local. Updating to version 151.0.7922.72 or newer removes the memory leak and eliminates the disclosure risk.