Google EUVD-2026-23066

Cross-origin data leakage in Google Chrome prior to 147.0.7727.101 allows a remote attacker to leak sensitive password data from other origins via a crafted HTML page, but only after they have already compromised the renderer process via a separate exploit. The vulnerability requires user interaction (visiting a malicious page) and has high attack complexity, resulting in a CVSS 3.1 base score of 3.1 (Low severity). No public exploit or active exploitation has been identified at time of analysis, and the EPSS probability is extremely low (0.01%).