This vulnerability in Google Chrome for iOS versions before 151.0.7922.72 is caused by insufficient validation of untrusted input. It allows remote attackers to perform UXSS attacks by injecting arbitrary scripts or HTML through malicious network traffic. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and limited confidentiality and integrity impact. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation status.

Successful exploitation could allow an attacker to inject and execute arbitrary scripts or HTML in the context of the victim's browser session, potentially leading to information disclosure or manipulation of web content. The impact is limited to confidentiality and integrity with no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should monitor for official updates from Google and apply them once available to mitigate this vulnerability.