The vulnerability in the Federated Credential Management (FedCM) implementation in Google Chrome permits an attacker to bypass the browser’s same origin policy by delivering a specially crafted HTML page. This flaw can cause the attacker to impersonate the user’s authenticated session, enabling credential theft or unauthorized actions across domains. The weakness stems from an improper handling of authentication contexts and is identified as CWE‑346.

All desktop releases of Google Chrome prior to version 151.0.7922.72, across all supported operating systems, are affected. The issue is resolved only in that release and later; versions before that lack the necessary safeguards.

The CVSS score of 6.5 indicates a medium‑severity vulnerability, whereas the EPSS score of <1 % indicates a low current exploitation probability. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a malicious webpage that the user must load, implying that social engineering tactics are required for exploitation.