Chrome versions before 157.0.8103.38 contain an incorrect authorization check in the Autofill AI component. A crafted HTML page can trigger the feature to retrieve sensitive user data belonging to another origin. This flaw allows a remote attacker to read cross‑origin information without permission, violating confidentiality and potentially exposing personal or payment details. The weakness corresponds to improper authorization.

Google Chrome desktop browsers before version 157.0.8103.38 are affected. Users of any platform running these Chrome releases are at risk if they navigate to a malicious web page that invokes Autofill AI.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, indicating limited public exploitation at this time. The CVE severity is medium, and the flaw requires a user to access a crafted page that triggers Autofill AI, so the attacker must have the ability to serve or embed malicious content in the victim’s browser. While the risk is not negligible, the lack of widespread exploitation suggests that the threat surface is moderate and can be mitigated by updating the browser.