The vulnerability is an insufficient policy enforcement in the Autofill feature of Google Chrome. A remote attacker can craft a malicious HTML page that, when loaded by a user, causes the browser to leak cross‑origin data through Autofill. This allows disclosure of sensitive personal or credential information stored in the Autofill database. The flaw is classified as CWE‑346, indicating a failure to enforce access controls on user data.

All releases of Google Chrome before version 151.0.7922.72 are affected. The issue exists in the desktop stable channel.

The CVSS score of 4.3 places this vulnerability in the medium severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability requires a remote attacker to first deliver a crafted web page to a user; it does not provide remote code execution or privilege escalation. The issue is not listed in the CISA KEV catalog. The likely attack vector is a web‑based interaction where the victim visits a malicious site that triggers the Autofill leak.