This vulnerability involves an inappropriate implementation in the Signin component of Google Chrome on iOS versions before 149.0.7827.53. It allows remote attackers to craft HTML pages that can spoof the user interface, potentially misleading users. The CVSS vector indicates the attack requires no privileges and user interaction, with low complexity and no confidentiality or availability impact, but with integrity impact limited to UI spoofing. There is no explicit remediation level or patch link provided in the data, but a vendor advisory URL is available for reference.

The impact is limited to UI spoofing, which could deceive users into interacting with malicious content under the guise of legitimate UI elements. There is no direct confidentiality or availability impact. No known exploits have been reported in the wild, indicating limited immediate risk.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor for official updates and apply any released patches promptly. Until a patch is confirmed, caution is advised when interacting with untrusted content on affected versions.