The vulnerability is an insufficient validation of untrusted input in the password handling component of Google Chrome. A remote attacker can deliver a malicious HTML page that includes a deceptive password form. When a user interacts with the form, the browser accepts the input as legitimate, allowing the attacker to masquerade as a trusted site and gather the user’s input. This UI spoofing does not guarantee credential theft but can mislead users into providing sensitive information to a malicious interface.

All desktop releases of Google Chrome with versions older than 148.0.7778.216 on macOS, Windows, and Linux are affected. The flaw is present in the password processing module across these operating systems.

The CVSS score of 5.4 indicates moderate severity, but the Chromium security severity is High, reflecting the potential for significant user deception. The EPSS score is below 1%, implying a low probability of exploitation in the current landscape, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a user to visit a crafted page containing malicious input; the attack vector is remote, relying on social engineering or a compromised site to lure the user to the page.