What it means
Chrome Password Checkup can flag a saved credential as exposed in a known breach or weak. An account takeover means someone actually gained access to the account. The first can raise the risk of the second, but they are not the same event.
A real-world example
A reused password appears in Checkup while the site's account activity shows no unknown sessions. The correct response is still to replace the password everywhere it was reused and enable stronger authentication.
What to do
Change the password on the legitimate site, check sessions and recovery methods, and address password reuse. Escalate to incident support if account activity suggests unauthorized access.
The distinction that matters
No alert does not prove every credential is safe: Checkup only covers credentials it can evaluate. A warning also may persist until the saved password is updated. Google describes compromised and weak findings as distinct categories.
Google's Password Manager guidance
