An implementation flaw in the Passwords feature of Google Chrome allows a remote attacker who convinces a user to perform specific UI gestures to cause the browser to unintentionally expose data that should remain confined to its origin. The vulnerability is categorized as a high severity security issue by Chromium, indicating that sensitive information could be accessed by the attacker. It directly exploits a weakness related to unintended control flow, which is represented as CWE-451, and the resulting impact is the leakage of data across origins, compromising confidentiality.

Google Chrome versions prior to 149.0.7827.155 are affected. This includes all desktop operating systems where the Chrome browser is installed and has not yet received the 149.0.7827.155 release or later. The flaw does not apply to Chrome builds that have incorporated the fix for 149.0.7827.155 or newer, nor to other browsers.

The CVSS score of 3.1 indicates a low overall severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. The attack requires a user to interact with a maliciously crafted HTML page that triggers specific UI gestures; thus the attacker must persuade or trick the user into performing the required gestures. Even if exploited, the impact is limited to leakage of cross-origin data and does not provide arbitrary code execution or system compromise.