A UI misrepresentation flaw in Chromium used in Google Chrome for iOS allows a remote attacker to display a fabricated address bar on a crafted web page. The attacker can social‑engineer users into believing the page is legitimate, potentially leading to credential theft or other phishing outcomes. The vulnerability is centered on display integrity (CWE‑451) and carries a medium severity rating.

Google Chrome on iOS versions earlier than 154.0.8037.57 are affected. No other platforms are listed. Users on these versions should verify the installed build and compare it to the official stable channel release.

The CVSS score of 5.4 reflects a moderate risk, and while the EPSS score is not available, the lack of a KEV listing suggests that widespread exploitation has not yet been observed. Exploitation requires a user to visit a malicious web page, meaning it is primarily a social‑engineering vector with no local privilege escalation or code execution. The impact is confined to user‑level phishing and the loss of trust in the browser UI.