Insufficient input validation in Chrome's passwords handling allowed a remote attacker to perform UI spoofing via malicious network traffic. The attacker can trick users into interacting with forged credential prompts, potentially leading to credential theft or phishing. The vulnerability is associated with CWE‑20, CWE‑290, and CWE‑451.

Google Chrome versions prior to 151.0.7922.72, especially on the stable channel, are affected. Users of older branches or custom builds that have not applied the 151.0.7922.72 update may also be vulnerable.

The CVSS score is 4.3, indicating low overall severity. The EPSS score is below 1 %, suggesting a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via network traffic, with a straightforward path for attackers to deliver the spoofing content. The potential impact is limited to user deception and credential compromise, but the low exploitation likelihood reduces the immediate risk.