The vulnerability resides in the password management logic of Google Chrome, where the enforcement of password policies is incorrectly applied. A remote attacker who has successfully compromised the renderer process can create a crafted HTML page that triggers the release of data originating from another origin. This results in the exposure of information that the victim’s browser holds but does not grant the attacker privilege escalation or denial of service. The weakness is an information‑exposure flaw.

All builds of Google Chrome up to and including 147.0.7727.100 are affected. Any installation that has not been updated to 147.0.7727.101 or later remains vulnerable, regardless of operating system.

The CVSS base score of 3.1 and an EPSS of less than 1% indicate a low likelihood of exploitation in the wild. The exploit path requires the attacker to first compromise the renderer process, usually via a separate foothold such as a malicious extension or another vulnerability. The vulnerability is not listed in the CISA KEV catalog. Consequently, the risk to an unpatched user is low; however, the potential impact of cross‑origin data disclosure could be significant if malicious data is retrieved.