This vulnerability leads to an information leak in Google Chrome’s password handling component. A specially crafted HTML page can cause Chrome to expose sensitive data that it stores locally, such as saved passwords or other confidential credentials, to a remote attacker. The flaw is categorized as CWE-200 and is rated a low severity by Chromium, but it still permits unauthorized access to private information.

Affected systems are installations of Google Chrome running any version older than 155.0.8059.39. Versions 155.0.8059.39 and later contain the fix, eliminating the information‑leak path.

The CVSS score of 8.8 indicates a high severity impact, signifying that an attacker who successfully exploits this flaw can gain access to confidential credential data. The vulnerability allows a remote attacker to obtain locally stored passwords by serving a malicious web page that triggers the leak, without requiring elevated privileges or additional authentication. The attack vector is remote, relying on a crafted HTML payload delivered via a web page. An attacker does not need to compromise the host system beyond making the victim visit the malicious page; the exploit path is straightforward and does not depend on user actions beyond opening the page. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the potential exposure of credentials justifies a high level of concern. The lack of publicly available exploit metrics does not diminish the risk, and system owners should prioritize applying the fix promptly.