The vulnerability arises from an improper implementation in Chrome’s credential‑management component that allows a remote attacker to load a crafted HTML page and trigger a counterfeit login interface. The flaw, identified as CWE‑303, does not grant code execution or privilege escalation but can lead to the disclosure of stored credentials if a user trusts the spoofed prompt. Consequently, the confidentiality of the user’s passwords is at risk when the malicious page is visited.

Google Chrome desktop browsers with versions earlier than 151.0.7922.72 are affected. The issue manifests in the desktop Chrome client on all supported operating systems; no separate web‑or storage‑specific versions were identified.

The CVSS score of 6.5 signals a medium severity, and the EPSS score of less than 1 % indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit this flaw by hosting a malicious website that displays the spoofed prompt; the attack vector is purely remote, requiring only a user’s visit to the page. The risk profile aligns with typical phishing campaigns, with the primary consequence being credential theft rather than system compromise.