Technical impact
A malformed HTML page can cause Chrome on iOS to misrepresent the address bar, allowing a remote attacker to spoof the URL presented to the user. The misuse of SecurityIndicators, identified by CWE-451, lets the browser display a falsified address that the user may believe is legitimate. This also aligns with CWE-290, where the browser does not properly authenticate the source of the address bar representation, potentially enabling broader unauthorized manipulation. This can lead to phishing attacks, credential theft, or other social‑engineering exploits.
Affected Systems
Google Chrome on iOS devices. All releases earlier than 154.0.8037.57 contain the issue; versions 154.0.8037.57 and newer incorporate the fix.
Risk and Exploitability
Based on the description, it is inferred that the attack appears to require remote delivery through a crafted web page, making the primary vector remote client‑side exploitation. The CVSS score of 5.4 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. While the potential for credential compromise exists, the lack of an active exploit prevention measure reduces immediate risk, yet the moderate score suggests that users should update promptly.
Debian DSA