A confused deputy flaw in the CredentialProvider in Google Chrome on Windows before 152.0.7977.75 lets a remote attacker who has already compromised the renderer process leak sensitive information through a specially crafted HTML page, resulting in a disclosure of credentials or other protected data. The weakness is categorized as CWE‑441 and is considered a low severity issue by Chromium security.

The vulnerability affects Google Chrome running on Windows systems, specifically versions earlier than 152.0.7977.75. An attacker must target a system where Chrome’s renderer process is running the untrusted content.

The EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. A CVSS score of 5.3 indicates a medium severity, and successful exploitation requires the attacker to have already positioned themselves within the renderer process via malicious web content. This makes the attack vector constrained and dependent on a pre‑existing compromise of the browser’s rendering engine.