Insufficient policy enforcement in the Passwords module of Google Chrome before version 150.0.7871.115 allows a remote attacker to bypass the Same‑Origin Policy by serving a crafted HTML page. The flaw is an input validation weakness identified as CWE‑20. The result is that a malicious page can access resources that should be restricted by origin checks, potentially exposing sensitive data or enabling further interaction with the user’s browsing context.

All users running a desktop build of Google Chrome older than version 150.0.7871.115 are potentially affected. The vulnerability is tied specifically to the Passwords component and does not relate to other product lines.

The CVSS score of 4.3 indicates moderate severity according to the CVSS framework, but Chromium labels the issue as High because it represents a direct policy bypass. The EPSS score of less than 1% suggests a very low probability of exploitation in the wild. Attackers would need to lure a victim to a maliciously crafted page; no privileged code execution or local interaction is required beyond viewing the page. The risk is therefore limited to scenarios where a user visits an untrusted site or opens a malicious file that renders the page technique.