A flaw in Google Chrome’s Password Manager before version 149.0.7827.53 permits a remote attacker who has gained control of a renderer process to bypass discretionary access control using a crafted HTML page. The underlying weakness is described as an insufficient policy enforcement, which allows unauthorized access to stored credentials. This maps to CWE-20, reflecting an input validation failure, and CWE-551, denoting a discretionary access control weakness.

Google Chrome desktop versions earlier than 149.0.7827.53 are affected. All stable channel releases built before this version contain the flaw, regardless of the specific operating system used, until the browser is updated to a fixed build.

The Chrome security team classified the issue with a CVSS score of 3.1, indicating low severity, and the EPSS score is <1%. It is not listed in the CISA KEV catalog. Exploitation requires that the attacker already compromise the renderer process; simply visiting a page is insufficient. While the flaw does not provide direct system‑wide compromise, it enables the theft of credentials stored in the Password Manager, presenting a significant risk in environments where the feature is enabled and sensitive passwords are stored.