The flaw is an information‑leak vulnerability in the Autofill component of Google Chrome. When a compromised HTML page is loaded in the browser, the attack can read sensitive data that the user has stored in Autofill, such as passwords, addresses, and payment information. This type of Weakness Identification (CWE-200) permits a remote data breach without needing direct access to the host system.

Google Chrome versions older than 155.0.8059.39 are affected. The problem arises in the Autofill code path and is not limited to a particular operating system or user privilege level.

The CVSS score of 8.8 indicates a high severity level. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation would typically involve a remote attacker delivering a maliciously crafted HTML page to a victim’s browser; if Autofill is active, confidential information becomes readable, constituting a significant confidentiality breach.