This vulnerability involves an incorrect security UI in the Passwords feature of Google Chrome versions prior to 151.0.7922.72. The flaw enables a remote attacker to conduct domain spoofing through a crafted HTML page, misleading users about the domain context of password-related UI elements. The CVSS 3.1 base score is 6.5 (medium), with no confidentiality impact but high integrity impact, requiring user interaction and no privileges. The vendor advisory linked does not explicitly state if a patch is available or if the issue is mitigated in the referenced version.

The vulnerability allows attackers to spoof domain information in the password UI, potentially tricking users into entering credentials or trusting malicious sites. There is no direct confidentiality or availability impact. The main risk is user deception leading to credential theft or phishing.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should update to Chrome version 151.0.7922.72 or later once confirmed. Until then, caution is advised when interacting with password prompts on untrusted sites.