This vulnerability in Google Chrome's Passwords feature arises from insufficient policy enforcement, which permits a remote attacker with control over the renderer process to extract sensitive data from process memory by delivering a specially crafted HTML page. The issue affects versions of Chrome before 150.0.7871.47. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. No known exploits in the wild have been reported. The vendor advisory linked corresponds to a stable channel update but does not explicitly confirm the patch status or remediation level.

An attacker who has already compromised the renderer process in affected Chrome versions can leverage this vulnerability to access potentially sensitive information stored in process memory related to passwords. This could lead to confidentiality breaches of user credentials. There is no impact on integrity or availability. The attack requires user interaction and has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users and administrators should update Google Chrome to version 150.0.7871.47 or later once the fix is confirmed. Until then, avoid interacting with untrusted content that could compromise the renderer process.