This vulnerability in Google Chrome's Passwords feature involves insufficient enforcement of security policies, enabling a remote attacker with control over the renderer process to exfiltrate cross-origin data through a specially crafted HTML page. The issue is tracked as CWE-284 (Improper Access Control). The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact. The affected version is any Chrome version prior to 150.0.7871.47. The vendor advisory URL is provided but does not explicitly state patch or fix status.

An attacker who has already compromised the renderer process can exploit this vulnerability to leak sensitive cross-origin data, impacting confidentiality. There is no impact on integrity or availability. The vulnerability requires user interaction and no privileges, making exploitation feasible but limited to scenarios where the renderer process is compromised.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed, users should update to Chrome version 150.0.7871.47 or later if available. No additional mitigation instructions are provided by the vendor advisory.