“We recover YouTube watch history from the Chrome browser for iOS, which is a shell on top of Safari’s browsing engine due to Apple’s App Store policy.”
A malicious webpage in Safari can read Gmail subject lines and passwords autofilled by a credential manager. The researchers told Apple on September 12, 2022, 408 days before going public. Apple forces every iOS browser onto its own engine, so switching to Chrome buys nothing. One engine by decree means one bug for everyone.