The vulnerability is an insufficient policy enforcement in the password management component of Google Chrome. A remote attacker who has already compromised the renderer process can craft an HTML page that triggers the leakage of data originating from another domain. The primary consequence is the exposure of sensitive cross‑origin information, potentially including credentials stored in the password manager, without providing an attacker direct code execution or denial of service capability. The weakness can be classified as an information exposure flaw.

Google Chrome installations up to and including version 147.0.7727.100 are affected. Any Chrome user running a build older than 147.0.7727.101 may be vulnerable unless other mitigations are in place.

Chromium labels the issue as low severity with a CVSS base score of 3.1. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation to date. The attack requires that an attacker already holds a foothold in the renderer process, which typically demands a separate compromise such as a malicious extension or a buffer overrun elsewhere. Because the exploit path is non‑trivial, the risk is moderate to low for a user with an unpatched browser, but the likelihood of exploitation in the wild remains uncertain.