This vulnerability involves an inappropriate implementation in Google Chrome on iOS versions before 149.0.7827.53 that permits a remote attacker to bypass the same origin policy by using a specially crafted HTML page. The same origin policy is a critical security mechanism that restricts how documents or scripts loaded from one origin can interact with resources from another origin. The weakness is identified as CWE-346 (Insufficient Policy Enforcement). The CVSS v3.1 base score is 4.3, indicating a medium severity level. There is no explicit vendor remediation level or patch link provided, but the affected versions are prior to 149.0.7827.53, implying that version 149.0.7827.53 is the fixed version.

The vulnerability allows a remote attacker to bypass the same origin policy in affected versions of Chrome for iOS, potentially enabling unauthorized interactions between web origins. This could lead to limited information disclosure or integrity issues within the browser context. However, the CVSS vector indicates no confidentiality impact (C:N), low integrity impact (I:L), and no availability impact (A:N). No known exploits are reported in the wild.

Users should update Google Chrome on iOS to version 149.0.7827.53 or later, where this vulnerability is addressed. Since no official remediation level or patch link is explicitly stated, users should refer to the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for the latest update information and confirm that their Chrome version is up to date. Patch status is not yet confirmed explicitly in the advisory, so checking the vendor advisory for current remediation guidance is recommended.