This vulnerability involves an incorrect security UI implementation in Google Chrome's password feature before version 149.0.7827.53. An attacker can exploit this by convincing a user to perform certain UI gestures on a maliciously crafted page, resulting in leakage of cross-origin data. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with high confidentiality impact but no integrity or availability impact. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

Successful exploitation can lead to unauthorized disclosure of sensitive cross-origin data from the user's browser context. This compromises confidentiality but does not affect integrity or availability of the system or data. The attack requires user interaction and remote network access.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and avoid performing unexpected UI gestures prompted by unknown sites.