This vulnerability in Google Chrome for iOS versions before 151.0.7922.72 is due to insufficient policy enforcement, enabling remote attackers to bypass navigation restrictions via a crafted HTML page. The issue is classified under CWE-602 (Improper Restriction of XML External Entity Reference). The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. The vendor has published a stable channel update announcement but has not explicitly stated the remediation level or patch availability in the provided advisory URL. No known active exploitation has been reported.

The vulnerability allows remote attackers to bypass navigation restrictions in Chrome for iOS, potentially enabling unauthorized navigation actions that could affect the integrity of user interactions or browsing experience. There is no confidentiality or availability impact reported. The medium severity rating reflects the potential for integrity impact without elevated privileges or confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users should update Chrome for iOS to version 151.0.7922.72 or later once available. Until then, exercise caution with untrusted HTML content that could exploit navigation restrictions.