An inappropriate implementation in the Autofill component of Google Chrome allows a remote attacker to leak cross‑origin data through a crafted HTML page. The flaw, categorized as CWE-346, enables an attacker to read sensitive autofill information that should be restricted to the originating origin, thereby compromising user privacy. The vulnerability is not a denial‑of‑service or code‑execution flaw, but the exposure of confidential data can lead to credential theft or other privacy violations.

Google Chrome browsers running versions prior to 151.0.7922.72 are impacted. Any user who loads a maliciously crafted web page while using those versions could be at risk of cross‑origin data leakage.

The CVSS score of 4.3 indicates medium severity, and the EPSS score of less than 1% suggests a very low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. The likely attack vector is remote through a crafted web page, meaning that any attacker who can supply a malicious site to a user will be able to trigger the data leak. Although the exploitation conditions are relatively simple, the low EPSS score and lack of a public exploitation reference imply that active attacks are uncommon at this time.