The vulnerability stems from incorrect security UI in the Omnibox of Google Chrome on iOS. Before version 147.0.7727.55, Chrome failed to properly display security indicators when a crafted domain name was entered, enabling attackers to make the Omnibox appear trustworthy. An adversary could therefore spoof URLs and create convincing phishing experiences, potentially leading users to divulge sensitive information. This weakness aligns with CWE‑451, which concerns prohibited functionality exploitation.

The flaw affected Google Chrome running on iOS devices, specifically versions earlier than 147.0.7727.55. Users of Chrome on other platforms, such as Android, Windows, macOS, or Linux, are not impacted by this particular issue.

The CVSS score of 5.4 indicates moderate risk, and the EPSS is under 1%, suggesting a low likelihood of exploitation. The vulnerability was not listed in the CISA KEV catalog, and the only known vector is a remote attacker targeting iOS Chrome via a crafted domain name. Because the flaw relies on user interaction with a fabricated URL, the attacker must successfully entice a user to visit the malicious domain. Despite this, the limited impact on confidentiality and integrity means the overall threat level remains low. Updating to a patched release mitigates the risk entirely.