Google Chrome for iOS contains an input validation flaw that allows an attacker who has already compromised the renderer process to craft an HTML page that bypasses the same origin policy. The vulnerability permits the attacker to read data from web pages of other origins, potentially leading to data exfiltration, cross‑origin scripting attacks, and related privacy violations. The flaw is classified as a CWE‑20 error and carries a high severity rating in Chromium’s internal scoring.

Affected vendors and products: Google Chrome on iOS. Versions before 148.0.7778.216 are vulnerable. No other platform or version information is provided.

The vulnerability is significant but its exploitation requires the attacker to first compromise the renderer process. EPSS score is < 1%, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. Nevertheless, the high severity rating and the ability to bypass core browser security boundaries warrant prompt attention. Attackers could exploit the flaw by delivering a specially crafted site once they have gained entry to the renderer, enabling cross‑origin data access.