Insufficient enforcement of the password storage policy in Google Chrome releases prior to 151.0.7922.72 permits a remote attacker to craft an HTML page that, when visited by an authenticated user, can read data considered protected by cross‑origin boundaries. The weakness is identified as CWE‑346, leading to unintended disclosure of credential‑related information. The impact is confined to the data visible in the victim’s browser session; it does not allow arbitrary code execution or system compromise. The vulnerability is medium severity (CVSS 4.3) and is not listed in CISA’s KEV catalog.

Google Chrome browsers with versions earlier than 151.0.7922.72 are affected. The specific CVE references entries for version 151.0.7922.72 and later indicate the fix has been applied. No other products or vendors are listed as vulnerable.

The threat has a CVSS score of 4.3 and an EPSS score of less than 1 %, suggesting a low probability of widespread exploitation at this time. The attack vector is remote, delivered through a crafted HTML page supplied by an external site. As the vulnerability allows leakage of cross‑origin data but not arbitrary code execution, the risk to a system depends on whether the exposed data is sensitive. The lack of a KEV listing further indicates that indicator‑based detection has not been reported as a high‑impact exploit in the wild.