EUVD-2026-50628
GHSA-24c5-cm69-pxc3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister attacker-controlled domain
-
DeliveryServe crafted HTML page exploiting Autofill origin flaw
-
ExploitLure victim via phishing or malvertising
-
ExecutionVictim visits page in unpatched Chrome
-
PersistAutofill leaks cross-origin data to page context
-
ImpactExfiltrate captured data to attacker server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | User interaction is required: the victim must actively navigate to an attacker-controlled HTML page in an unpatched Chrome browser (UI:R in CVSS vector). No authentication or special account privileges are needed by the attacker (PR:N). Chrome's Autofill feature must be enabled, which is the default out-of-box configuration-no non-default setting is required to be vulnerable. Exploitation is bounded by the low confidentiality impact: only partial cross-origin data is accessible, not full credential dumps or session tokens, limiting the immediate utility per interaction. The attack cannot be fully automated without user participation, which limits opportunistic mass exploitation campaigns. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) reflects a network-reachable, low-complexity, zero-privilege attack that nonetheless requires user interaction (UI:R), caps out at low confidentiality impact (C:L), and has no integrity or availability consequences. These metrics are internally consistent: real exploitation requires convincing a user to visit an attacker-controlled page, limiting mass automation. EPSS at 0.22% (12th percentile) confirms the exploitation probability is well below average for disclosed CVEs, consistent with the Medium Chromium security severity designation. There is no KEV listing and no public exploit code identified, meaning this has not been observed in active threat campaigns. The primary real-world risk is targeted information theft-scenarios where an attacker specifically wants to harvest Autofill-accessible cross-origin data from a known victim profile. For general enterprise populations this represents a lower-priority patch than a high-CVSS remote code execution, but Chrome's ubiquitous deployment means even a modest attack rate produces meaningful exposure at scale. |
| Exploit ScenarioDerived | An attacker registers a domain and serves a page containing crafted HTML that abuses the Autofill implementation flaw to trigger cross-origin data observation. A targeted user is sent a phishing link and, upon visiting the page in an unpatched Chrome browser, the page exfiltrates partial data from a cross-origin context (such as values Autofill would populate) back to the attacker's server. No public exploit code has been identified at time of analysis, making this scenario currently dependent on independent rediscovery of the Chromium issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update Chrome via Settings > Help > About Google Chrome or through enterprise deployment tooling (Google Admin Console, Intune, etc.). The stable channel update advisory is published at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. If immediate upgrade is not possible, disabling the Autofill feature for forms and passwords (chrome://settings/autofill) removes the vulnerable code path at the cost of convenience-Autofill suggestions will no longer populate, requiring manual entry. Restricting access to untrusted external websites via network policy or DNS filtering is a secondary control that reduces exposure surface but does not eliminate the vulnerability for pages that bypass perimeter controls.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) indicates the Chrome Autofill engine does not correctly validate that data surfaced or triggered by a page originates from-or is scoped to-the same origin as the requesting document. The Autofill subsystem interacts with form fields and browser-stored credentials/payment data across page contexts; a failure in origin gating can allow a cross-origin page to observe Autofill-populated values or trigger their disclosure indirectly. The CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms (Windows, macOS, Linux, ChromeOS) prior to the fixed build. Chromium issue tracker reference 522878450 was filed internally and is the upstream bug driving this fix.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-reachable via crafted page requiring no authentication, but passive user navigation is mandatory; impact is partial cross-origin data disclosure only, no integrity or availability consequence.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB