An inappropriate implementation in Chrome’s Autofill feature allows a remote attacker to craft a web page that, through user‑initiated gestures, presents deceptive input fields. The resulting UI spoofing can cause users to enter sensitive data—such as usernames and passwords—into the wrong form, potentially sending that data to a malicious server. This flaw is a CWE‑451 credential exposure, potentially allowing users to inadvertently submit sensitive information.

Google Chrome versions prior to 150.0.7871.47 are affected. Versions 150.0.7871.47 and newer contain the fix as noted in the release notes. No other browsers or versions are listed as impacted.

The CVSS score of 4.2 indicates medium severity. The EPSS score of less than 1% suggests a very low but non‑zero likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a malicious website that tricks a user into interacting with deceptive UI elements; exploitation therefore requires social engineering rather than a network‑level attack.