The flaw originates from an incorrect iOS implementation in Google Chrome before version 148.0.7778.216. A crafted HTML page can bypass the browser’s same‑origin policy, allowing a remote attacker to read data from other origins that the user has visited. This leaks confidential information that should be protected, representing an information exposure consistent with CWE‑200.

Google Chrome for iOS versions older than 148.0.7778.216 on all iOS devices is impacted. No other browsers or vendors are listed as affected.

Chromium assigns a CVSS score of 4.3, but the description rates the issue as high severity, reflecting the potential for significant information exposure. The EPSS score is less than 1%, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a hostile web page that a user opens, enabling the attacker to read protected data from other origins. Until the browser is updated, the risk of data disclosure remains active.