Google Chrome versions prior to 152.0.7977.65 exhibit an observable discrepancy in the Autofill feature. A crafted HTML page can trigger this flaw, enabling a remote attacker to read sensitive autofill data that the browser stores locally. The weakness is an error handling issue, identified as CWE-203, which permits unintended leakage of confidential information.

All installations of Chrome from earlier than 152.0.7977.65 are affected. The vulnerability applies to the stable channel of the browser and impacts users who have enabled Autofill for passwords, addresses, or payment information. No specific operating systems are listed, so any platform running those versions is potentially vulnerable.

The flaw is exploitable from any remote web page, so the attack vector is remote with no local privileges required. The CVSS score is 5.3, the Chromium severity is rated medium, and the EPSS score is <1%. It is not listed in the CISA KEV catalog, indicating no known large‑scale exploitation yet. Nonetheless, because it permits disclosure of stored autofill data, the risk to confidentiality is significant for affected users.