CVE-2026-10937 is a vulnerability in Google Chrome's password handling prior to version 149.0.7827.53. It enables a remote attacker to bypass the same origin policy by using a crafted HTML page, potentially exposing sensitive password data across origins. The vulnerability is categorized under CWE-346 (Origin Validation Error) and has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality and integrity without requiring privileges and with user interaction. The vendor advisory is available but does not explicitly state patch or fix details.

Successful exploitation could allow an attacker to bypass the same origin policy, potentially leading to unauthorized access to password data managed by Chrome. This compromises the confidentiality and integrity of user credentials. There is no indication of impact on availability. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution when interacting with untrusted web content, especially crafted HTML pages that may attempt to exploit this vulnerability.