Insufficient validation of untrusted input in the Password Manager component of Google Chrome allows a remote attacker to send crafted network traffic that can cause the browser to display spoofed login prompts. This flaw can mislead a user into believing they are interacting with a legitimate password request, potentially leading to credential disclosure. The weakness is a classic input‑validation failure (CWE‑20).

Google Chrome users running versions prior to 149.0.7827.53 are affected, as the vulnerability is only fixed in later releases. The flaw lies specifically within the Password Manager feature of the browser.

Chromium classifies the vulnerability with a medium severity. EPSS data is not available, and the KEV status indicates it is not listed in the CISA KEV catalog, suggesting limited public exploitation. The attack requires an attacker to deliver malicious traffic while the user employs the Password Manager, indicating a remote, user‑interaction‑based vector that can compromise credential confidentiality and integrity.