EUVD-2026-50769
GHSA-mxwh-pw9g-gqfj
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted HTML page (AV:N), no privileges needed (PR:N), user navigation mandatory (UI:R), limited confidentiality only (C:L), no integrity or availability impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.
Technical ContextAI
The vulnerability affects Google Chrome's Autofill subsystem, the browser component responsible for automatically populating form fields with saved addresses, credentials, and payment data. The root cause is CWE-346 (Origin Validation Error): Chrome's Autofill enforcement logic does not adequately validate the requesting origin, permitting a crafted HTML page to elicit or observe Autofill-supplied data that should be scoped to a different origin under the same-origin policy. The affected product is identified by CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, covering all Chrome desktop builds prior to 151.0.7922.72. The Chromium issue tracker reference (issues.chromium.org/issues/517493101) is the authoritative upstream bug record, though it is likely access-restricted pending broader patch adoption.
RemediationAI
The primary fix is upgrading Google Chrome to version 151.0.7922.72 or later via the browser's built-in update mechanism (Settings > Help > About Google Chrome) or enterprise deployment tooling; details are available at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. For managed environments where immediate update deployment is not feasible, administrators may reduce attack surface by disabling Chrome's Autofill features through enterprise policy (AutofillAddressEnabled=false, AutofillCreditCardEnabled=false, AutofillProfileEnabled=false); note this removes convenience functionality for end users and does not constitute a full remediation. Web content filtering to block navigation to untrusted or unknown HTML pages provides additional depth-of-defense but is not a substitute for patching.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today