EUVD-2026-40512
GHSA-x645-x4fh-pph5
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AC:H reflects the mandatory renderer-compromise precondition; PR:L captures that attacker must already hold renderer-level access before exploiting the Autofill flaw.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
AnalysisAI
Cross-origin data leakage via Chrome's Autofill implementation on Android allows a remote attacker with prior renderer process compromise to extract sensitive data across origin boundaries using a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) reflects low observed exploitation activity; however, the cross-origin data exposure (CWE-346) combined with Autofill access creates meaningful privacy risk for users on vulnerable Android builds. Google has released a patch in the stable channel update.
Technical ContextAI
CWE-346 (Origin Validation Error) describes failures to properly enforce same-origin policy - the browser security boundary that prevents one web origin from reading resources belonging to another. Chrome's Autofill subsystem on Android surfaces form data (credentials, addresses, payment info) that may span navigations or iframes. An 'inappropriate implementation' in Autofill's origin validation logic means a compromised renderer can query or observe Autofill-populated values from a different origin than the one the renderer is legitimately operating under. The affected CPE is Chrome for Android prior to version 150.0.7871.47. Renderer process compromise - typically achieved via a separate memory corruption or logic bug in the V8 JavaScript engine or Blink rendering engine - is a precondition, making this a second-stage exploit within a chained attack.
RemediationAI
Update Google Chrome for Android to version 150.0.7871.47 or later. This patch is available through the Google Play Store and through the Chrome stable channel; users should verify their installed version in Chrome Settings > About Chrome and enable automatic updates if not already active. The vendor advisory is documented at http://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. If immediate patching is not feasible, the effective risk can be reduced by disabling Chrome's Autofill feature (Settings > Autofill and Passwords) on affected Android devices, which removes the vulnerable data surface - note this disables convenience features including saved passwords and addresses. Restricting use of Chrome on Android for high-sensitivity workflows (banking, HR portals) until patched is a defensible interim measure with minimal operational trade-off.
Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today