The vulnerability causes Chrome to omit or incorrectly display the domain in the password prompt, allowing a remote attacker to trick users into revealing credentials for a fraudulent site. This is a CWE‑1021 misuse of secure UI logic that poses a confidentiality risk by potentially enabling credential theft.

All Google Chrome desktop installations running a version older than 151.0.7922.72 are affected. The issue does not apply to non‑desktop platforms or other vendors; the fix was released in the 151.0.7922.72 update.

The CVSS score of 6.5 places the vulnerability in the medium range. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis and it is not listed in CISA's KEV catalog. The attack surface is remote; a malicious web page can trigger the UI misbehavior without any additional pre‑conditions beyond a user visiting the page. Because the exploit is driven by a crafted HTML document, it could be deployed via a phishing email or compromised website, making the attack vector likely through social engineering. Due to the low exploitation probability and lack of widespread public exploitation reports, the immediate risk to a typical organization is moderate, but it remains important to mitigate.