Chromium's Autofill component improperly handled cross-origin form data, enabling a malicious HTML page to access entries from other domains. The flaw allows a remote attacker who can host a crafted page to obtain sensitive information such as saved passwords or credit card numbers, thereby compromising user confidentiality. The weakness corresponds to CWE-346, an improper handling of cross-origin references.

Google Chrome browsers running on any operating system and built prior to version 151.0.7922.72 are affected. The vendor supplied fix was backported into the 151.0.7922.72 release, so all earlier builds remain vulnerable until updated.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests that exploitation activity is currently unlikely. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to host a malicious page that the victim visits; no local or elevated privileges are needed. Although the attack is limited to information disclosure, the leaked data could be leveraged for more sophisticated credential‑stealing operations.