Technical impact
Google Chrome’s Autofill feature, before version 149.0.7827.53, contained insufficient policy enforcement that allows a remote attacker to bypass discretionary access control protections. By sending a specifically crafted HTML page to the victim’s browser, the attacker can gain unauthorized privileges or cause the browser to perform actions it should be prohibited from executing. This results in a breach of confidentiality, integrity, or availability of the user’s data within the Chrome environment.
Affected Systems
The vulnerability affects desktop installations of Google Chrome with versions earlier than 149.0.7827.53. No operating‑system restrictions were identified; the flaw is present on any platform where such an old Chrome build is run.
Risk and Exploitability
The CVE is classified as medium severity with a CVSS score of 6.5 and is not listed in CISA KEV. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability. The attack vector is inferred to be remote, delivered via a crafted HTML page that the user interacts with, implying that any user visiting a malicious site while running an affected Chrome version could be compromised. Given the lack of public exploit data, exploitation probability remains considered low.
Debian DSA