A crafted HTML page can trigger an information leak in Google Chrome’s password handling on Android devices running versions earlier than 155.0.8059.39. The flaw allows a remote attacker, typically using a social engineering approach, to extract sensitive information stored by Chrome without the user’s active consent. This weakness is classified as CWE‑200, which focuses on unintended data exposure.

Android installations of Google Chrome prior to version 155.0.8059.39 are affected. The exact build range is not specified beyond the stated upper bound, so all older builds should be considered vulnerable until a patch is applied.

The CVSS score of 8.8 indicates a high severity vulnerability. No EPSS data or KEV listing is available, indicating a modest exploitation probability. However, exploitation requires the victim to load a maliciously crafted page, so the attack vector is user‑initiated social engineering. Once the page is accessed, the attacker can retrieve the compromised data. Because the flaw is internal to Chrome’s password subsystem, it does not require elevated privileges or additional access beyond the normal browsing context.