This vulnerability arises from insufficient policy enforcement in the Autofill component of Google Chrome on iOS versions before 149.0.7827.53. An attacker can craft an HTML page that causes cross-origin data leakage, violating the same-origin policy. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS vector indicates the attack requires no privileges but does require user interaction. The vendor has published a stable channel update, but explicit patch or remediation details for this specific issue are not confirmed in the advisory.

Successful exploitation allows a remote attacker to leak sensitive cross-origin data from the browser's Autofill feature, compromising user confidentiality. There is no impact on data integrity or availability. The vulnerability requires user interaction and can be exploited remotely without privileges.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome on iOS to version 149.0.7827.53 or later once the fix is confirmed. Until then, exercise caution when interacting with untrusted web content that could exploit Autofill.