The vulnerability is an inappropriate implementation in Chrome’s password handling code that allows a remote attacker to craft a web page that, if a user performs certain UI gestures, will cause the browser to expose cross‑origin data. The exposure occurs through the password UI and is triggered by interaction with the page, resulting in a medium‑severity data leak.

Google Chrome versions prior to 151.0.7922.72 are affected. All builds of the stable channel on desktop platforms that have not been updated to patch this bug remain vulnerable.

The CVSS score of 4.3 classifies this as medium severity, while the EPSS score of less than 1 % indicates a very low observed exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires user interaction with a crafted page that performs specific UI gestures, so the attack vector is user‑initiated and depends on convincing the victim to engage with malicious controls.