Proper password change procedures generally require the old password to update it, so the code running on that page theoretically has access to both and can run

Proper password change procedures generally require the old password to update it, so the code running on that page theoretically has access to both and can run a similarity check. But my opinion is that ensuring creative passwords with an unclear similarity rule will only result in creative bypasses of that rule.