This vulnerability involves an inappropriate implementation in the Autofill component of Google Chrome before version 149.0.7827.197. An attacker with control over the renderer process can exploit this flaw to leak data across origins by using a specially crafted HTML page. The flaw compromises the same-origin policy protections by leaking sensitive autofill data. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation status in the input data.

The vulnerability enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin autofill data, potentially exposing sensitive user information. This undermines the browser's security model and user privacy. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted content and consider updating to the latest Chrome version once available.