The flaw in the password handling of Google Chrome before version 149.0.7827.53 permits a malicious web page to circumvent the browser’s same‑origin policy. An attacker can cause the browser to treat a request for a resource from a different origin as if it originated from the same origin, allowing the page to read data it normally could not access.

Google Chrome browsers prior to 149.0.7827.53, including all builds on the stable channel that have not applied the latest update, are vulnerable. The issue applies across all operating system platforms supported by Chrome.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the CVE carries a high severity rating. Based on the description, it is inferred that the attacker must trick a user into visiting a crafted HTML page that interacts with the browser’s password subsystem; no additional privileges or local access are required beyond a normal user session.