Insufficient policy enforcement in the Passwords component of Google Chrome allows an attacker who has already compromised a renderer process to extract data from other origins through a specially crafted HTML page. The flaw is classified as CWE‑346 and has been labeled a High‑severity issue by Chromium engineering, indicating the potential breadth of leaked information.

All installations of Google Chrome earlier than version 151.0.7922.72 are vulnerable. The problem persists until the browser receives the update that fixes the policy enforcement, which is available in the stable channel update released in July 2026.

The CVSS score of 3.1 places the weakness in the low‑severity range according to the standard metric set, and an EPSS score of less than 1 % signals a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to gain control of a renderer process; once achieved, the attacker can use the flaw to read cross‑origin data via a crafted HTML document. The combination of low CVSS and low EPSS suggests that the overall risk is modest, though it remains non‑negligible for environments that run outdated Chrome versions.