The vulnerability is a side‑channel information leakage flaw in the Chrome Forms component. By loading a specially crafted HTML page, a remote attacker can cause Chrome to expose data that belongs to a different origin, effectively leaking confidential information from a user’s session. This is a CWE‑1300 and CWE‑205 type weakness and constitutes a data‑exposure risk.

Google Chrome users with versions earlier than 149.0.7827.53 are affected. The flaw exists in the stable channel of the browser and any instance that has not received the latest security update is vulnerable.

The vulnerability is not listed in CISA’s KEV catalog and its EPSS score is less than 1%, indicating low current exploitation probability. The attack requires a user to visit a malicious webpage that triggers the side‑channel; once the page is rendered, cross‑origin data can be read. The CVSS score of 9.1 indicates high severity, and the potential impact could be substantial if sensitive data is exposed. No public exploit code is currently known.