The vulnerability resides in the Autofill component of Google Chrome and permits a remote attacker who has already compromised the renderer process to obtain cross‑origin data through a crafted HTML page. This inappropriate implementation can lead to the unintended disclosure of sensitive information, thereby breaching confidentiality. The flaw is identified as a high‑severity issue by Chromium’s security team.

Google Chrome browsers prior to version 149.0.7827.197 are affected. The vulnerability targets the renderer process.

The flaw carries a high severity rating, and while EPSS data is not available, the vulnerability is not listed in CISA KEV; the fact that an attacker must first compromise the renderer process limits the scope to situations where the renderer is already under threat. Nevertheless, the ability to leak cross‑origin data exposes a significant confidentiality risk that can be exploited with a crafted page delivered over the network, making it a high priority for remediation.