An improper implementation of the Views component in Google Chrome on iOS allows a remote attacker who has already compromised the renderer process to craft a malicious HTML page that mimics legitimate UI elements. This enables the attacker to deceive users by presenting counterfeit dialog boxes or input fields. The vulnerability is classified as Medium severity by Chromium and does not provide remote code execution, data exfiltration, or other gains unless the attacker has already gained renderer process control.

The flaw affects all installations of Google Chrome for iOS running versions earlier than 148.0.7778.168. Chrome 148.0.7778.168 and later contain the fix, so any same‑from‑Google flagship release on the iOS platform is protected once upgraded to that or newer versions.

The CVSS score is 4.2, and no EPSS score is available, indicating that the exploitation probability is unknown. The issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has access to the renderer process—such as via a local device compromise, a malicious extension, or a vulnerability that grants process control—after which they can serve a specially crafted webpage or embed malicious content in an otherwise legitimate site. Because the renderer runs locally, the primary attack vector is local to the device, but a malicious actor who controls the device could also publish a phishing link that forces Chrome to load the deceptive page.