The vulnerability allows a local attacker gains access to sensitive information by exploiting a flaw in the Mobile component of Google Chrome for iOS. The defect is an information leak that can expose confidential data; it is identified as CWE-200. The attacker does not obtain arbitrary code execution or business impact beyond privacy violations. The disclosure is consistent with a medium severity rating given by Chromium security.

Users running Google Chrome on iOS with versions earlier than 154.0.8037.57 are affected. The issue was reported to Chrome’s maintainers as issue number 517596255. All prior Stable channel builds before the 154.0.8037.57 release are vulnerable, while the 154.0.8037.57 update and later releases contain the fix.

The attack requires physical proximity to the device, making it a local exploitation scenario. No remote attack vector is known. The CVSS score of 4.6 indicates a medium severity, consistent with the Chromium severity rating. Because the vulnerability is local and the user must have direct access to the device, the likelihood of widespread exploitation is low, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The primary risk is confidentiality compromise for a user who can physically touch the device rather than a system‑wide compromise.