Google Chrome CVE-2026-18009

Exploitation requires that the target user is actively using Google Chrome prior to version 151.0.7922.72 and that their browser encounters malicious network traffic - either by visiting an attacker-controlled site or being subject to a network-layer injection. The CVSS vector UI:R confirms user interaction is mandatory; passive background operation of the browser is insufficient. PR:N confirms no attacker authentication or account privileges are required. AC:L indicates no race conditions or exceptional configuration is needed beyond the user browsing to attacker-influenced content. Exploitation is limited by: (1) the requirement for user interaction, (2) the scope-unchanged impact meaning the flaw cannot pivot to the underlying OS or other browser processes, and (3) the impact being limited to UI integrity (I:L) with no direct confidentiality or availability consequence. The Passwords component must be active and processing input - users who have disabled Chrome's built-in password manager may have reduced exposure to this specific attack surface.

All available signals converge on a low-to-negligible real-world exploitation risk. CVSS 4.3 (Medium) is driven primarily by network reachability and low complexity, but is tempered by the requirement for user interaction (UI:R) and a scope-unchanged, integrity-only impact (I:L). EPSS of 0.15% at the 5th percentile is extremely low, suggesting the broader researcher community has not assessed this as practically exploitable at scale. SSVC confirms exploitation: none and automatable: no, meaning the attack cannot be trivially scripted against large populations. The vulnerability is not listed in CISA KEV, and no POC has been identified. The 'Information Disclosure' tag in the intelligence metadata is potentially misleading - the CVE description specifically describes UI spoofing rather than direct data exfiltration; the disclosure risk is indirect, arising from social engineering enabled by a spoofed credential prompt. Overall, this is a genuine but low-urgency issue: patch as part of normal browser update cadence rather than emergency response.

An attacker hosts or injects malicious network content - such as a crafted web page or man-in-the-middle response - that delivers specially formed data to Chrome's Passwords component when a target user is browsing. The insufficient input validation causes the browser to render a spoofed password-related UI element (such as a fake autofill prompt or credential dialog), which could deceive the user into believing a legitimate credential action is occurring. No public exploit code exists for this vulnerability, and the attack requires active user engagement with the browser during the malicious network interaction.