An improper input validation flaw in the authentication component of Google Chrome allows a foot‑print attacker who already controls a renderer process to exploit social engineering and extract sensitive data from a crafted HTML page. The vulnerability was rated Medium by Chromium and can lead to accidental release of confidential information, but it does not directly enable arbitrary code execution or denial of service.

The flaw affects Google Chrome browsers on all platforms prior to version 154.0.8037.57. Older releases are potentially vulnerable until the security patch is installed; newer builds contain the corrected input validation.

The CVSS base score is 6.5, indicating a moderate severity, and the EPSS score is not available, so the likelihood of exploitation is unknown. The vulnerability is not listed in the CISA KEV catalog, though it could be abused by attackers who have already compromised a renderer process. Inference about the attack vector is that a remote attacker would need to lure a user into visiting a malicious web page to trigger the vulnerability, making social engineering a key component.