EUVD-2026-39037
GHSA-3mjj-7mcj-gxwq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects mandatory renderer-process compromise prerequisite; S:C reflects cross-origin boundary violation; PR:N as no additional auth is needed beyond the renderer foothold.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage in Google Chrome's Autofill implementation allows a remote attacker who has already achieved renderer process compromise to exfiltrate sensitive cross-origin data via a specially crafted HTML page. Affected versions include all Chrome releases prior to 149.0.7827.197; the flaw was reported by the Chrome security team and rated High severity by Chromium. No public exploit code has been identified and no active exploitation is confirmed, though the vulnerability chains onto a renderer compromise making real-world exploitation a two-stage attack.
Technical ContextAI
Google Chrome's Autofill subsystem - responsible for suggesting and populating form field data - contains an inappropriate implementation flaw (CWE not formally assigned) that can be triggered from within a compromised renderer process. The Chromium security model isolates web content in renderer processes with reduced privileges via a sandbox; this vulnerability represents a data-plane boundary violation where Autofill's handling of a crafted HTML page allows cross-origin data to be read or inferred from within the renderer sandbox without proper origin enforcement. The affected CPE is cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covering all Chrome versions below 149.0.7827.197. The Chromium issue tracker entry (https://issues.chromium.org/issues/516734537) is the primary upstream reference; as is typical for active Chromium reports, full technical details are likely restricted pending broader patch adoption.
RemediationAI
Update Google Chrome to version 149.0.7827.197 or later immediately via the Chrome menu → Help → About Google Chrome, or via enterprise deployment tools using the vendor's stable channel. The advisory is published at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0482630350.html. For environments where immediate patching is not feasible, the most meaningful compensating control is preventing renderer process compromise in the first place by enforcing Chrome's existing site isolation policies (--enable-strict-origin-isolation) and ensuring all available Chrome sandbox features are active; disabling or restricting Autofill via enterprise policy (AutofillEnabled=false) would eliminate the vulnerable code path but at the cost of losing all autofill functionality. Network-layer mitigations (URL filtering, proxy inspection) do not mitigate this vulnerability since the attack surface is within the browser itself.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today