EUVD-2026-28075Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network delivery via crafted page requires only user visit (UI:R); PR:N as no account needed; limited read-only data leakage, no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Insufficient policy enforcement in Autofill in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.
Technical ContextAI
The vulnerability resides in Google Chrome's Autofill subsystem, which automatically populates web form fields with user-stored data including addresses, payment card details, and credentials. CWE-346 (Origin Validation Error) identifies the root cause: the Autofill engine failed to adequately validate and enforce the Same-Origin Policy, the foundational browser security boundary that prevents a document or script from one origin from reading resources belonging to a different origin. When the Autofill feature is triggered on a crafted page, the insufficient policy checks allow it to expose or leak data scoped to another origin. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms the scope spans all platform variants of Google Chrome prior to 148.0.7778.96. Tags for Red Hat and SUSE indicate that downstream Linux distributions shipping Chromium-based browser packages track this flaw through their own advisory channels.
RemediationAI
The primary remediation is to upgrade Google Chrome to version 148.0.7778.96 or later, which resolves the insufficient policy enforcement in the Autofill component. The vendor-released patch is documented in the Chrome Stable Channel Update advisory at http://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html. For environments where immediate upgrade is constrained, a compensating control is to disable the Autofill feature in Chrome settings (Settings > Autofill and payments > uncheck all Autofill options), which eliminates the vulnerable code path at the cost of losing form auto-population convenience. Red Hat and SUSE administrators should apply updated Chromium packages via their respective package managers (dnf/yum or zypper) once patched packages are published through their advisory channels.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: MediumShare
External POC / Exploit Code
Leaving vuln.today