EUVD-2026-50865
GHSA-c59g-pfwx-wvf7
Severity by source
Sources disagree (Low–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network vector, no privileges needed, but active user interaction required; impact is limited to low integrity (UI spoofing only) with no confidentiality or availability effects.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
5DescriptionCVE.org
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
Technical ContextAI
The vulnerability resides in Chrome's built-in Passwords component - the credential storage, autofill, and password save/fill prompt subsystem. CWE-20 (Improper Input Validation) identifies the root cause: the component fails to sufficiently validate untrusted data received over the network before using it to render password-related UI elements, such as credential save prompts or autofill suggestions. This class of flaw allows attacker-controlled values to influence what the user sees in these UI surfaces, potentially fabricating convincing but deceptive credential dialogs. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72 across all platforms.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-confirmed fix version documented in the stable channel release advisory at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome applies updates automatically for most consumer deployments, but enterprise administrators managing Chrome via group policy or endpoint management platforms (such as Google Admin console or third-party MDM) should verify successful rollout using version reporting. If immediate patching is delayed, risk can be partially mitigated by instructing users not to interact with unexpected password save or autofill prompts on untrusted networks, and by enforcing HTTPS-only browsing policies to reduce exposure to man-in-the-middle traffic manipulation - though neither control fully eliminates the exposure since HTTPS traffic can still originate from attacker-controlled origins.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today