EUVD-2026-50936
GHSA-5gqf-j5mm-3j2q
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network delivery requires no attacker privileges, but mandatory user interaction limits automation; integrity-only impact as spoofed UI may redirect credential submission with no confidentiality or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.
Technical ContextAI
CWE-451 (UI Misrepresentation of Critical Information) captures cases where a rendered UI element misleads users about the nature of data or actions they are taking. In Chrome's password manager implementation, an inappropriate handling of network-delivered content allows crafted traffic to influence how password-related UI - such as autofill prompts or credential save dialogs - is presented to the user. This can cause the browser to display misleading context about the target site or credential scope. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop versions prior to 151.0.7922.72 across platforms. The root cause is not a memory-safety issue but a logic/presentation flaw in how the Passwords feature processes or reflects externally-supplied information.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which resolves this vulnerability per the Chrome Stable Channel advisory (http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome auto-updates on most desktop configurations; verify the installed version via chrome://settings/help and confirm it reads 151.0.7922.72 or higher. Enterprise administrators deploying Chrome via policy (Google Admin Console or ADMX templates) should push the update through their management channel and confirm endpoint compliance. No documented workaround exists for this UI spoofing issue - the patch is the definitive remediation. Given the low CVSS score and no active exploitation, this update can be applied on the normal patch cycle rather than as an emergency deployment.
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today