This vulnerability involves an inappropriate implementation in the password handling component of Google Chrome before version 151.0.7922.72. An attacker who has already compromised the renderer process can exploit this flaw to leak data across origins by using a specially crafted HTML page. The issue is classified under CWE-346 (Origin Validation Error). The CVSS 3.1 base score is 3.1, reflecting low impact with network attack vector, high attack complexity, no privileges required, and user interaction needed.

The impact is limited to confidentiality, allowing an attacker to leak cross-origin data. There is no impact on integrity or availability. The attack requires the attacker to have already compromised the renderer process and the victim to interact with a malicious HTML page. No known active exploitation has been reported.

A fixed version of Google Chrome is available starting with version 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. Since this is a client-side application, patching the browser is the recommended and effective mitigation. No additional vendor advisory states otherwise.