EUVD-2026-50769
GHSA-mxwh-pw9g-gqfj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page with exploit form fields
-
DeliveryVictim navigates to attacker page in unpatched Chrome
-
ExploitAutofill origin policy enforcement bypassed
-
ExecutionCross-origin Autofill data exposed to page script
-
ImpactAttacker script reads and exfiltrates leaked data
Vulnerability Assessment
| Weakness |
CWE
|
| Exploitation Conditions | User interaction is a hard prerequisite: a victim must navigate to and load the attacker-controlled HTML page in an unpatched Chrome browser, as confirmed by the CVSS UI:R metric and SSVC's 'not automatable' rating. Chrome's Autofill feature must be active, which is the default configuration for desktop Chrome installations. No authentication, elevated privileges, or special system access is required of the attacker (PR:N, AV:N). Exploitation is strictly bounded to confidentiality - specifically cross-origin data surfaced through Autofill - with no integrity or availability impact and no scope change beyond the current browser context (S:U). Users who have disabled Autofill via settings or enterprise policy are not affected by this specific flaw. |
| Impact | The CVSS 3.1 score of 4.3 (Medium) is consistent with the actual signal set: the attack vector is network (AV:N) and requires no privileges (PR:N), but user interaction is mandatory (UI:R) and the impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence. The EPSS score of 0.21% (11th percentile) reflects very low probability of near-term exploitation in the wild. SSVC independently rates exploitation as 'none,' the vulnerability as not automatable, and technical impact as only partial - all consistent with EPSS. There is no CISA KEV listing and no public exploit code identified. The convergence of low EPSS, no KEV, not-automatable SSVC, and limited-scope CVSS impact metrics indicates this is a genuine low-priority patching item for most organizations rather than an emergency response trigger, notwithstanding Chrome's ubiquitous deployment footprint. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page containing form elements engineered to trigger Chrome's Autofill subsystem in a manner that bypasses its origin validation logic. When a victim with Autofill enabled navigates to the page, Chrome incorrectly surfaces cross-origin Autofill data - such as saved address or form values associated with a different origin - which the attacker's page script can then read and exfiltrate. No public exploit code has been identified at time of analysis, and the attack is not automatable per SSVC, requiring deliberate victim navigation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or enterprise deployment tooling; details are available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed environments where immediate update deployment is not feasible, administrators may reduce attack surface by disabling Chrome's Autofill features through enterprise policy (AutofillAddressEnabled=false, AutofillCreditCardEnabled=false, AutofillProfileEnabled=false); note this removes convenience functionality for end users and does not constitute a full remediation. Web content filtering to block navigation to untrusted or unknown HTML pages provides additional depth-of-defense but is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability affects Google Chrome's Autofill subsystem, the browser component responsible for automatically populating form fields with saved addresses, credentials, and payment data. The root cause is CWE-346 (Origin Validation Error): Chrome's Autofill enforcement logic does not adequately validate the requesting origin, permitting a crafted HTML page to elicit or observe Autofill-supplied data that should be scoped to a different origin under the same-origin policy. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72. The Chromium issue tracker reference (issues.chromium.org/issues/517493101) is the authoritative upstream bug record, though it is likely access-restricted pending broader patch adoption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted HTML page (AV:N), no privileges needed (PR:N), user navigation mandatory (UI:R), limited confidentiality only (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB