This vulnerability involves insufficient data validation in the Autofill implementation of Google Chrome before version 149.0.7827.53. An attacker can exploit this flaw by crafting a malicious HTML page that causes cross-origin data leakage. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, resulting in high confidentiality impact but no integrity or availability impact. The vulnerability is categorized under CWE-352 (Cross-Site Request Forgery). No known exploits are reported in the wild, and no official remediation level or patch is confirmed in the provided data. The vendor advisory link is available but does not explicitly state patch status.

Successful exploitation can lead to unauthorized disclosure of sensitive data across origins, compromising user privacy and confidentiality. There is no impact on data integrity or system availability. The attack requires no privileges and no user interaction, making it relatively easy to exploit remotely.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and consider disabling Autofill features if possible.