The vulnerability arises from insufficient enforcement of the Passwords policy150.0.7871.47. This weakness is catalogued as CWE‑693. A remote attacker can deliver a crafted HTML page that bypasses the same‑origin restriction, allowing the page to read and exfiltrate data that belongs to a different origin. The attack likely requires a user to open a malicious web page; the description does not state usual context for cross‑origin data leaks. The result is exposure of sensitive information such as stored credentials or other origin‑specific data to a malicious page from another origin.

The flaw affects release earlier than version 150.0.7871.47 of Google Chrome. All users running an outdated Chrome build on the desktop stable channel are potentially vulnerable until they upgrade to the patched version.

The CVSS score of 6.5, medium severity range, and the EPSS score of less than 1 % indicates a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. While the risk is confined to browsers that have not applied the security update, cross‑origin data leakage an attacker who can entice users to visit a malicious site, yet the attack requires no additional privileged context beyond a standard web page load.