An incorrect security UI in Chrome’s Omnibox on iOS allows a remote attacker to display a spoofed URL through a specially crafted domain name. The rendering flaw enables the browser to present altered address information without redirecting the user, enabling deceptive phishing attempts. The weakness involves a UI rendering inconsistency that permits domain manipulation. Google rates this issue as low severity.

Chrome for iOS versions earlier than 147.0.7727.55 are affected. Users running any build before this release remain vulnerable until they upgrade the browser to a newer version that includes the UI fix.

No CVSS score is published and the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to entice a user into visiting a maliciously crafted domain; if the user enters that domain in the address bar, the browser will display the spoofed URL. The impact is limited to user deception and does not provide code execution or direct access to the device. Based on the available information, the risk level is moderate; widespread exploitation has not been reported.