Google Chrome’s Password Manager contains an improper implementation that allows a remote attacker to leak cross‑origin data through a crafted HTML page. When a user visits a malicious site, the browser can expose credentials that it would normally autofill for a different domain, leading to disclosure of sensitive login information. The vulnerability aligns with weaknesses such as missing authentication for critical functions and Cross‑Site Request Forgery (CWE-346, CWE-352). The issue represents a medium‑severity information exposure flaw.

The issue affects Chrome on desktop operating systems. Any installation running a version of Chrome older than 149.0.7827.53 is vulnerable; earlier releases are also likely affected. The flaw does not depend on platform or administrative privileges, making it broadly applicable across Windows, macOS, and Linux users who use the default Password Manager.

The vulnerability is rated Medium with a CVSS score of 6.5. The EPSS score of less than 1 percent indicates a low likelihood that an active exploit will be seen in the wild, and it has not appeared in CISA’s KEV catalog. The likely attack vector is an attacker delivering a malicious web page (hosted over HTTP or HTTPS) that the victim visits, which triggers the inappropriate Password Manager behavior. No local privilege escalation or special network configuration is required; the attack is purely web‑based and remote.