Technical impact
Insufficient validation of untrusted input in the Password Manager component of Google Chrome allows a remote attacker to send crafted network traffic that can cause the browser to display spoofed login prompts. This flaw can mislead a user into believing they are interacting with a legitimate password request, potentially leading to credential disclosure. The weakness is a classic input‑validation failure (CWE‑20). Additionally, the flaw can be seen as a cross‑site scripting vulnerability (CWE‑79).
Affected Systems
Google Chrome users running versions prior to 149.0.7827.53 are affected, as the vulnerability is only fixed in later releases. The flaw lies specifically within the Password Manager feature of the browser.
Risk and Exploitability
Chromium classifies the vulnerability with a medium severity (CVSS score 4.3). The EPSS score is below 1%, indicating a very low probability of exploitation. The KEV status shows it is not listed in CISA KEV, suggesting limited public exploitation. The attack requires an attacker to deliver malicious traffic while the user employs the Password Manager, indicating a remote, user‑interaction‑based vector that can compromise credential confidentiality and integrity. The vulnerability is a classic input‑validation failure (CWE‑20) and can also be considered a cross‑site scripting flaw (CWE‑79).
Debian DSA