A flaw in Chrome’s password handling system allows a remote attacker to leak cross‑origin data via a crafted HTML page. The vulnerability is an instance of CWE‑346, the failure to properly authenticate a request before granting access to sensitive information. The description does not state that stored passwords can be read; it only indicates that data from one origin can be accessed from another origin by a malicious page.

Google Chrome users running any version prior to 151.0.7922.72 are affected across all supported operating systems, as the issue resides in the Passwords component of the browser. No specific OS restrictions are reported; the vulnerability applies globally to builds before the stated patch level.

The CVSS score of 4.3 indicates medium severity, while the EPSS score of less than 1% suggests exploitation is unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires the user to open a malicious page, the likelihood of a successful exploitation depends on user interaction. Nonetheless, the potential for cross‑origin data leakage justifies timely remediation.