This vulnerability arises from an inappropriate implementation in Chrome's Passwords component, allowing an attacker who has already compromised the renderer process to leak data across origins through a crafted HTML page. The primary impact is the unauthorized disclosure of cross-origin information; it does not provide remote code execution or system-wide privileges. The weakness aligns with CWE‑346, an authorization bypass via user‑controlled keys.

All instances of Google Chrome older than 151.0.7922.72 are affected. The issue applies to the renderer process on Windows, macOS, and Linux platforms. No further vendor or product distinctions are specified beyond the Chrome browser.

The CVSS score of 3.1 indicates a low severity overall, and the EPSS score is below 1%, reflecting a very low expected exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to first compromise the renderer process, after which a crafted HTML page can trigger the cross-origin data leak. Given these prerequisites, the practical risk remains low.