The vulnerability is due to improper input validation in the Passwords module of Google Chrome. A malicious page can spoof password UI elements, tricking a user into entering credentials into counterfeit inputs. This type of flaw matches CWE-20. Because the displayed UI may appear authentic, an attacker could obtain the entered passwords. The weakness is categorized as a low severity in Chromium's internal ranking, and the CVSS score of 5.4 reflects a moderate risk.

All installations of Google Chrome that are earlier than version 154.0.8037.57 are impacted. The fix is included in the Chrome 154.0.8037.57 release and subsequent stable updates. No further version details are listed in the CNA data.

The attack requires the victim to visit a crafted HTML page, which typically means the attacker must host a malicious website or deliver a phishing page. The CVSS score of 5.4 indicates a moderate impact if successful, but the absence of an EPSS score means no public data quantifies exploitation likelihood. The vulnerability is not listed in CISA's KEV catalog, suggesting no known widespread exploitation. Consequently, while the flaw poses a risk of credential compromise through UI spoofing, it relies on user interaction and does not provide remote code execution or privilege escalation.