This vulnerability in Google Chrome's Password Manager arises from insufficient validation of untrusted input, enabling remote attackers to conduct UI spoofing attacks by leveraging malicious network traffic. The issue affects versions prior to 149.0.7827.53. The CVSS score is 4.3 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact. No known exploits in the wild have been reported. The vendor advisory link is provided but does not explicitly confirm patch availability in the input data.

The vulnerability allows remote attackers to perform UI spoofing, potentially misleading users by presenting deceptive user interface elements. This can lead to user confusion or tricking users into unintended actions. There is no direct impact on confidentiality or availability. The integrity impact is limited to UI spoofing.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed, users should exercise caution with untrusted network content and avoid interacting with suspicious UI elements that could be spoofed.