EUVD-2026-50935
GHSA-v7fw-cxg2-xxgc
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery with no privileges required, but mandatory user interaction limits reach; UI spoofing yields only low integrity impact with no confidentiality or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.
Technical ContextAI
The flaw resides in Chrome's built-in Passwords manager component, responsible for handling credential autofill prompts and related UI surfaces. CWE-20 (Improper Input Validation) identifies the root cause: externally supplied data from network traffic is not adequately sanitized or validated before being processed by the Passwords subsystem, enabling an attacker to influence the rendered UI. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* for all versions prior to 151.0.7922.72. The CVSS vector AV:N/AC:L confirms the attack is network-reachable with no special environmental complexity, while UI:R indicates the user must be interacting with the browser (e.g., visiting a malicious or attacker-influenced page) for exploitation to succeed. The chromium severity classification is 'Low', consistent with the contained integrity-only impact.
RemediationAI
The primary fix is updating Google Chrome to version 151.0.7922.72 or later, which is available via Chrome's built-in auto-update mechanism or through the vendor stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Enterprise administrators can enforce this version via policy. Given the low severity and the absence of active exploitation, emergency patch deployment is not warranted; inclusion in the next standard patch cycle is appropriate. There are no documented vendor-provided workarounds for environments that cannot immediately update. Compensating controls are limited given the network attack vector, but enforcing web content filtering to restrict access to untrusted or unknown domains reduces the attack surface by limiting exposure to malicious network traffic that could trigger the flaw.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today