The issue is related to the deletion of HPKP pins during cache clearing, which makes it easier for remote attackers to spoof web sites via a valid certificate from an arbitrary recognized Certification Authority. This occurs in the browser/browsing data/browsing data remover.cc component.