A flaw in Chrome’s Autofill handling permitted a remote attacker to leak sensitive cross‑origin information through a specially crafted HTML page. The issue stems from an inappropriate implementation that exposes data controlled by a different web origin, allowing partial disclosure of user data and potentially compromising privacy. The weakness is classified as CWE-346, indicating weak protection against data leakage via control flow mismanagement.

Google Chrome browsers showing the embedded Autofill component are affected, specifically any installation of Chrome before version 151.0.7922.72. Users on earlier stable releases are at risk, while newer releases above that version have incorporated the fix.

The CVSS score of 4.3 categorizes the vulnerability as moderate, and the EPSS score of less than 1 % indicates a very low likelihood of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, suggesting no active exploitation campaigns are documented. A remote attacker would need to convince a victim to open a crafted HTML page that exercises the Autofill logic; upon doing so, data from a different origin could be exposed. Given the remote nature of the attack and the requirement for victim interaction, the overall risk remains limited but non‑zero.