This vulnerability arises from insufficient enforcement of security policies in the Passwords feature of Google Chrome before version 147.0.7727.101. An attacker who has already compromised the renderer process can exploit this weakness to leak data across origins via a specially crafted HTML page. The issue compromises the browser's same-origin policy protections related to password data handling. The vulnerability is publicly disclosed and assigned CVE-2026-6312, with a high severity rating by Chromium security. No CVSS score or explicit remediation level is provided in the input data. The vendor advisory URL is available but does not contain patch or mitigation details in the provided information.

The impact is that a remote attacker with control over the renderer process can leak sensitive cross-origin data, potentially exposing user passwords or other confidential information managed by Chrome's Passwords component. This undermines the browser's security model and could lead to data exposure. There are no known exploits in the wild as per the provided data.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Since the vulnerability affects versions prior to 147.0.7727.101, updating to version 147.0.7727.101 or later is recommended if confirmed by the vendor advisory. No specific temporary mitigations are described in the provided information.