EUVD-2026-93705
GHSA-v224-f3c7-mxwg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page
-
ExploitLure victim to visit URL
-
ExecutionTrigger Autofill info-leak flaw
-
ImpactExfiltrate sensitive autofill data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to navigate an unpatched Chrome build (any version prior to 155.0.8059.39) to an attacker-controlled crafted HTML page - this user-interaction requirement (CVSS UI:R) is the primary limiting factor. No authentication and no special privileges are needed (PR:N), and default Chrome configurations with Autofill are affected, so there is no non-default-setting prerequisite. The attack is purely client-side against the browser; there is no server-side component and no persistence, limiting impact to disclosure of whatever sensitive data the Autofill component exposes per victim visit. |
| Impact | Signals conflict sharply on this one. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) yields an 8.8 'High', but that vector is inconsistent with the vulnerability class: this is an information leak (CWE-200) in Autofill that Google's own Chromium team rated only 'Medium'. An information-disclosure bug should not carry I:H and A:H - you cannot write data or crash the system by leaking it. The realistic impact is confidentiality-only, which lowers the true base score to roughly 6.5. No EPSS score, no CISA KEV listing, and no confirmed public exploit were provided, so there is no evidence of active or imminent exploitation. The chromium.org issue link is a bug tracker reference, not released exploit code. Net assessment: this is a genuinely patchable browser flaw worth routine prioritization given Chrome's ubiquity and the no-privilege/network vector, but the headline 8.8 overstates the real risk - treat it as a Medium-severity confidentiality issue requiring only victim navigation to a malicious page, not a critical RCE-class emergency. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures a victim into visiting it (phishing link, malicious ad, or compromised site). When the page loads in an unpatched Chrome build, a flaw in the Autofill component leaks sensitive stored information (such as form or autofill data) to the attacker-controlled page. Exploitation requires user interaction (visiting the page) but no authentication or special privileges; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in Google Chrome's Autofill component lets a remote, unauthenticated attacker read sensitive data by luring a victim to a crafted HTML page on any Chrome build prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must actually navigate to the attacker's page - which is the primary limiting factor, and no non-default configuration or privileges are needed since Autofill is enabled by default. The independent assessment scopes impact to confidentiality only (C:H/I:N/A:N), while the supplied vector additionally claims high integrity and availability impact; no public exploit code and no confirmed active exploitation have been identified at time of analysis, and vendor-patched builds are available.
RemediationAI
Vendor-released patch: upgrade to Google Chrome 155.0.8059.39 or later - this is the exact fixed version named in the Chrome Stable Channel advisory (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html). In practice Chrome's auto-update will pull this automatically, but the update only takes effect after the browser is fully restarted, so verify the running build via chrome://version and force a relaunch; managed fleets should push 155.0.8059.39 through their enterprise update policy and confirm compliance rather than relying on user-initiated restarts. Where immediate updating is not possible, the only directly effective compensating control is to remove the attack surface by disabling Autofill through enterprise policy - for example AutofillAddressEnabled=0 (and the corresponding credit card/contact autofill policies where applicable) - at the cost of losing saved-form convenience for all users and generating helpdesk friction, and it mitigates only the Autofill data path, not any other exposure in the same unpatched build. Restricting browsing to a managed allowlist or blocking untrusted sites reduces the chance of a victim reaching a crafted page, but is high-overhead and breaks general web use. Note that sandboxing, Site Isolation, and renderer hardening do not address a logic-level origin-scoping flaw of this kind, so they should not be treated as substitutes for the update; with no public exploit code identified, emergency network controls are not warranted, but the confidentiality-only impact per the independent assessment should not be understated simply because the supplied CVSS vector is inflated by integrity and availability claims.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-200 information exposure in Chrome's Autofill subsystem, the component that stores and injects saved addresses, contact details, and form history into web pages based on origin and field heuristics. Rather than a memory-safety bug, this class of defect typically stems from a logic error in how Autofill decides which origins or frames are entitled to see which stored entries, allowing a crafted page to trigger disclosure of data that should remain scoped to the user's own profile. CPE data (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) wildcards the version field, meaning every Chrome release before 155.0.8059.39 - Windows, macOS, Linux, and mobile derivations of the same Chromium stable train - should be treated as affected; ENISA tracks the same issue as EUVD-2026-93705. Chromium's own security severity rating is Medium, which conflicts with the provided CVSS score of 8.8, and the independent assessment resolves this toward the lower end (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, roughly 6.5), treating the issue as a confidentiality-only client-side leak with no server-side component and no persistence.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted-page attack needs victim navigation (UI:R) but no privileges (PR:N); an information leak affects confidentiality only, so I:N and A:N, unlike the input vector.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome builds prior to 155.0.8059.39 contain an information-disclosure flaw in the default-enabled Autofill component that could allow an attacker to read sensitive data stored in the browser if an employee is lured to a crafted web page. Because Autofill is on by default and holds personal and payment details, the exposure affects any workforce member using an unpatched browser, though exploitation depends entirely on user interaction and no public exploit or active exploitation has been observed. The vendor has released a fixed build, so the residual risk is a straightforward patch-management problem rather than an urgent incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB