A flaw in Google Chrome’s Password Manager before version 149.0.7827.53 permits a remote attacker who has gained control of a renderer process to bypass discretionary access control using a crafted HTML page. The underlying weakness is described as an insufficient policy enforcement, which allows unauthorized access to stored credentials. This maps to CWE-20, reflecting an input validation failure.

Google Chrome desktop versions earlier than 149.0.7827.53 are affected. All stable channel releases built before this version contain the flaw, regardless of the specific operating system used, until the browser is updated to a fixed build.

The Chrome security team classified the issue with a low severity score and no EPSS value is available. It is not listed in the CISA KEV catalog. Exploitation requires that the attacker already compromise the renderer process; simply visiting a page is insufficient. While the flaw does not provide direct system-wide compromise, it enables the theft of credentials stored in the Password Manager, presenting a significant risk in environments where the feature is enabled and sensitive passwords are stored.