EUVD-2026-50580
GHSA-j542-7g8v-jfg9
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-process compromise prerequisite, which materially elevates attack complexity beyond the official AC:L rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.
Technical ContextAI
Google Chrome's multi-process architecture isolates web content in renderer processes separated from the privileged browser process. The Passwords component - responsible for credential save/fill prompts and the password manager UI - accepts input from the renderer layer; CWE-20 (Improper Input Validation) indicates that this input channel does not sufficiently validate untrusted data before using it to construct UI elements. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome variants (Windows, macOS, Linux, Android) prior to 151.0.7922.72 are within scope. An attacker controlling the renderer process (e.g., via a separate renderer-level exploit) can inject malformed data that causes the Passwords subsystem to render spoofed credential prompts or permission dialogs in the trusted browser chrome, bypassing the visual security boundary users rely on.
RemediationAI
The primary fix is upgrading to Google Chrome 151.0.7922.72 or later, which is confirmed available via the vendor's stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's auto-update mechanism will deliver this on standard schedules; enterprise environments using managed deployments should push the update immediately. As a compensating control, organizations can reduce exposure by enforcing Chrome's site isolation policies (--site-per-process, already default in modern Chrome), which raises the bar for renderer compromise - though this does not eliminate the underlying validation flaw. Disabling the built-in password manager entirely (via policy: PasswordManagerEnabled=false) would prevent exploitation of this specific component at the cost of losing integrated credential management. No workaround fully mitigates the flaw without patching.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today