A flaw in Chrome’s handling of password prompts allows a remote adversary to extract cross‑origin user data when a victim engages in specific UI gestures on a malicious web page. The vulnerability stems from inadequate isolation of password‑related dialogs, enabling the attacker to read sensitive information that should remain hidden to the page’s origin. Consequently, confidentiality of user credentials or other entered data is at risk.

Google Chrome versions earlier than 149.0.7827.53 on all supported operating systems (Windows, macOS, Linux, Android, iOS) are affected.

Exploitation requires a victim to browse a crafted site and intentionally interact with the password UI, conditions that are typically achieved through social engineering or phishing. The Chromium security team rated the issue as Low; no CVSS score is publicly available, and the EPSS score is not reported. The vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation. Still, the potential for confidential data leakage warrants proactive mitigation.