Google Chrome EUVD-2026-50936

Exploitation requires the victim to be running Google Chrome prior to 151.0.7922.72 on a desktop platform and to actively interact with attacker-controlled network traffic - for example, visiting a malicious page or resource that triggers the password UI. User interaction is explicitly required (UI:R in the CVSS vector); passive, background exploitation without a user action is not possible. The flaw is scoped specifically to Chrome's Passwords feature and is not a generic browser-engine issue. Limiting factors include: mandatory active user interaction (UI:R), the attack is not automatable per SSVC, Chromium rates this Low severity indicating a narrow practical impact surface, and no authentication or elevated privileges are required of the attacker. The exact network trigger (e.g., specific HTTP response headers, redirects, or content types that influence the password UI) is not publicly detailed.

CVSS 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N indicates network-reachable, low-complexity attack requiring user interaction, with limited integrity impact and no confidentiality or availability consequences. EPSS at 0.15% (5th percentile) reflects very low observed exploitation probability across the broader threat landscape. SSVC independently confirms exploitation status as none, the attack is not automatable, and technical impact is only partial - all three signals align and consistently indicate low operational urgency. The vulnerability is not listed in CISA KEV. The mandatory user interaction (UI:R) is a meaningful limiting factor: passive drive-by exploitation without any victim action is not possible. Despite network accessibility and no attacker privileges required, the convergence of low EPSS, no KEV listing, non-automatable SSVC classification, and UI:R requirement make this a low priority relative to other network-reachable, unauthenticated vulnerabilities. The 'Information Disclosure' tag in the input is noted but appears inconsistent with the CVSS impact metrics (C:N) - the primary impact is integrity-based UI misrepresentation, not direct data exfiltration.

An attacker hosts a malicious web resource and directs a Chrome user to interact with it; the malicious network traffic causes Chrome's password UI to render spoofed prompts that misrepresent the site context or credential target. The victim, trusting the falsified Chrome UI, submits credentials intended for a legitimate service, which are instead captured by the attacker. No public exploit code is identified at time of analysis, and replication requires user interaction rather than passive browsing.