The Google Chrome password manager has a flaw that lets a malicious web page capture stored credentials. A remote attacker can craft an HTML page that, when a user visits it, causes Chrome to leak sensitive password data. This issue is a data confidentiality weakness (CWE-200). The disclosed information could be used to compromise user accounts and other protected data.

Google Chrome desktop installations running versions earlier 155.0.8059.79 are affected; it is inferred that this applies regardless of operating system because the description contains no OS‑specific restriction. It is further inferred that the vulnerability is present in all standard builds of the browser prior to that release.

The CVSS score of 6.5 indicates a moderate risk, and the EPSS score of <1% suggests that practical exploitation is currently rare. It is not listed in the CISA KEV catalog, meaning no confirmed active exploits are known. Based on the description, it is inferred that an attacker must persuade a user to load a malicious web page, typically through phishing or social engineering, before exploiting the fault.