EUVD-2026-50580
GHSA-j542-7g8v-jfg9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim visits attacker-controlled HTML page
-
DeliverySeparate renderer exploit compromises renderer process
-
ExploitMalformed input sent to Passwords component via IPC
-
ExecutionInsufficient validation accepts spoofed UI data
-
PersistPassword manager dialog rendered with attacker-controlled content
-
ImpactUser deceived into credential disclosure
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires two sequential conditions: first, the victim must visit a crafted HTML page (UI:R per CVSS) that triggers a renderer-process compromise via a separate, chained vulnerability - this renderer compromise is an explicit prerequisite stated in the CVE description. Second, the attacker must exercise the compromised renderer to deliver malformed input to Chrome's Passwords subsystem. The vulnerability itself does not enable initial access; it is a post-renderer-compromise privilege escalation within Chrome's internal IPC boundary. Exploitation is limited to Chrome versions prior to 151.0.7922.72. No authentication to any external service is required, but the renderer compromise prerequisite is the primary real-world limiting factor. There is no evidence of exploitation against default configurations without a chained renderer exploit. |
| Impact | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) yields a 6.5 Medium, but this vector does not capture a critical prerequisite: the attacker must have already compromised the renderer process before this flaw is exploitable. In practice, attack complexity is materially higher than AC:L implies - this is a chained exploit requiring a separate renderer vulnerability. EPSS at 0.21% (11th percentile) reflects this elevated bar accurately. The vulnerability is not listed in CISA KEV, and no POC has been identified. Real-world risk is therefore conditional on the availability of a compatible renderer exploit, which significantly reduces the realistic threat pool to sophisticated actors. The integrity impact (I:H) is genuine - successful spoofing of password UI can lead to credential theft - but the prerequisite renderer compromise is the binding constraint. This should be patched on standard cadence rather than treated as an emergency. |
| Exploit ScenarioDerived | An attacker serving a malicious web page first exploits a separate renderer-level vulnerability to gain code execution within Chrome's renderer process. Using that foothold, they send malformed, unsanitized input to the Passwords component, causing Chrome to render a spoofed password save or autofill prompt that mimics a legitimate browser security dialog. The victim, trusting the browser chrome UI, interacts with the spoofed prompt - potentially submitting credentials to an attacker-controlled endpoint or approving a malicious action under the guise of a trusted browser dialog. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.
RemediationAI
The primary fix is upgrading to Google Chrome 151.0.7922.72 or later, which is confirmed available via the vendor's stable channel update (https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html). Chrome's auto-update mechanism will deliver this on standard schedules; enterprise environments using managed deployments should push the update immediately. As a compensating control, organizations can reduce exposure by enforcing Chrome's site isolation policies (--site-per-process, already default in modern Chrome), which raises the bar for renderer compromise - though this does not eliminate the underlying validation flaw. Disabling the built-in password manager entirely (via policy: PasswordManagerEnabled=false) would prevent exploitation of this specific component at the cost of losing integrated credential management. No workaround fully mitigates the flaw without patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Google Chrome's multi-process architecture isolates web content in renderer processes separated from the privileged browser process. The Passwords component - responsible for credential save/fill prompts and the password manager UI - accepts input from the renderer layer; CWE-20 (Improper Input Validation) indicates that this input channel does not sufficiently validate untrusted data before using it to construct UI elements. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome variants (Windows, macOS, Linux, Android) prior to 151.0.7922.72 are within scope. An attacker controlling the renderer process (e.g., via a separate renderer-level exploit) can inject malformed data that causes the Passwords subsystem to render spoofed credential prompts or permission dialogs in the trusted browser chrome, bypassing the visual security boundary users rely on.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
AC:H reflects the mandatory renderer-process compromise prerequisite, which materially elevates attack complexity beyond the official AC:L rating.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB