The vulnerability is a use-after-free flaw in Google Chrome for iOS that permits an attacker to force a user to perform specific UI gestures on a crafted HTML page. When the gesture is performed, the affected memory location is accessed after it has been freed, allowing arbitrary code execution. This gives an attacker full control over the device, enabling the compromise of secrets, data exfiltration, or further malware installation.

Google Chrome for iOS versions earlier than 148.0.7778.216 are affected. The flaw is limited to iOS Chrome; other browsers or Chrome on other platforms were not impacted.

The flaw carries a high severity rating from Chromium, with a CVSS score of 7.5, but its exploit requires user interaction in a web page. The EPSS is not available, and the vulnerability is not in the CISA KEV catalog. Attackers must convince a user to perform specific gestures while viewing a malicious page, which lowers the likelihood of exploitation but still poses a significant risk to users who visit untrusted sites. Once exploited, the attacker can gain arbitrary code execution privileges on the device.