EUVD-2026-50589
GHSA-rw9v-fqfw-2qxc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRegister lookalike domain
-
DeliveryCraft HTML page triggering Passwords UI misrepresentation
-
ExploitDeliver page link to victim
-
InstallVictim visits page in unpatched Chrome
-
C2Incorrect domain displayed in password prompt
-
ExecuteVictim saves or autofills credentials for attacker domain
-
ImpactAttacker harvests submitted credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the victim to visit a crafted HTML page using an unpatched Chrome browser (any version prior to 151.0.7922.72), and to interact with Chrome's built-in Passwords UI during that visit - for example, by accepting a save-credentials prompt or allowing autofill. The CVSS vector PR:N confirms no authentication is needed on the attacker's side. The key limiting factor is UI:R: passive browsing alone does not trigger the vulnerability; the user must engage with the password manager interface on the crafted page. The flaw is specific to Chrome's integrated Passwords component - browsers using separate third-party password managers or with Chrome's built-in password manager disabled via enterprise policy are not affected by this specific UI misrepresentation. No server-side configuration or privileged network position is required by the attacker. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) scores 6.5 Medium, reflecting a network-delivered attack requiring no privileges but needing victim interaction (visiting a crafted page). The High Integrity impact captures misdirection of credential actions rather than direct data exfiltration. EPSS at 0.18% (8th percentile) is very low, suggesting no observed exploitation activity at time of scoring. There is no CISA KEV listing and no known public exploit. The practical threat is primarily a phishing-enabler: an attacker who can convince a user to visit a crafted page may harvest credentials stored for legitimate sites. While not trivially exploitable at scale, Chrome's ubiquity means the exposed population is enormous. The gap between high Integrity CVSS and low EPSS is consistent with a social-engineering-dependent flaw rather than a mass-exploitation target. No conflicting signals were observed in the available data. |
| Exploit ScenarioDerived | An attacker registers a lookalike or typosquatting domain and serves a crafted HTML page that triggers Chrome's incorrect password UI rendering. When the victim visits the page in an unpatched Chrome browser, the Passwords UI displays a spoofed or misrepresented domain name, leading the user to believe a credential prompt or autofill event belongs to a trusted site. The victim then saves credentials or accepts autofill for the attacker's domain, enabling subsequent account compromise. No public exploit code is currently known, making large-scale automated campaigns unlikely at this time. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.
RemediationAI
Upgrade Google Chrome to version 151.0.7922.72 or later - this is the vendor-confirmed fixed release documented in the Chrome stable channel update at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome typically auto-updates, so ensuring the auto-update mechanism is not disabled is the primary action for most users and administrators. As a compensating control for environments where immediate patching is delayed, security teams can disable Chrome's built-in password manager via enterprise policy (PasswordManagerEnabled=false) and redirect users to a separately managed password manager - note this disrupts user workflow and may lead to weaker credential hygiene. User awareness guidance around verifying domain indicators before accepting password save/autofill prompts can reduce exploitation likelihood in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause: Chrome's Passwords UI fails to correctly display or validate the security origin when rendering certain crafted HTML constructs, breaking the browser's trust boundary between domains. The affected component is the built-in Chrome password manager - not a third-party extension - which relies on accurate domain attribution to correctly autofill, save, or prompt for credentials. When this domain signal is spoofed at the UI layer, users may save credentials against a malicious origin or be misled about which domain a password prompt belongs to. CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome browser versions across platforms prior to the fixed 151.0.7922.72 release. The Chromium security team rated this Medium severity internally.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no privileges needed, user must interact; integrity high due to credential misdirection; no confidentiality or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB