This vulnerability in Google Chrome relates to insufficient enforcement of security policies within the password management feature. Specifically, it allows a remote attacker to craft an HTML page that can leak data across origins, violating the same-origin policy. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, and high confidentiality impact. The vulnerability affects versions prior to 150.0.7871.47. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation level.

An attacker can remotely cause a user to visit a malicious HTML page that leaks sensitive cross-origin data related to passwords stored in Chrome. This leads to a confidentiality breach without affecting data integrity or availability. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Users should update to version 150.0.7871.47 or later once confirmed. Until then, no specific mitigation steps are provided by the vendor.