Insufficient validation of untrusted input in the passwords module of Google Chrome allows an attacker in a privileged network position to inject malicious traffic that triggers the browser to display a spoofed password prompt. This flaw enables UI spoofing that could trick users into revealing credentials, compromising confidentiality. The weakness is an input validation error classified as CWE‑20.

Google Chrome versions earlier than 151.0.7922.72 are affected. Any system running one of these versions is vulnerable to the described UI‑spoofing attack.

The CVSS score of 4.3 indicates a low severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to be in a privileged network position to manipulate network traffic directed at the target browser. Based on the description, it is inferred that such an attacker would be positioned on the same local network, making this a local‑network exploitation scenario rather than a remote attack.