EUVD-2026-50600
GHSA-gvh4-9j76-m35h
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessExploit separate Chrome renderer RCE vulnerability
-
DeliveryAchieve code execution in compromised renderer process
-
ExploitDeliver crafted HTML page to victim
-
ExecutionTrigger Autofill side-channel timing or resource observable
-
PersistMeasure cross-origin data signal
-
ImpactExfiltrate inferred Autofill field contents
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware access control bypass
|
| Exploitation Conditions | Exploitation requires two explicit preconditions: (1) the attacker must have already compromised the Chrome renderer process through a separate, independent vulnerability - this CVE is not a standalone attack vector; and (2) the victim user must interact with a crafted HTML page while the renderer compromise is active (UI:R per CVSS). The Autofill feature must be active, which is the default Chrome configuration. Key limiting factors: the renderer-compromise prerequisite is a substantial barrier that typically requires chaining with a higher-severity renderer exploit; the impact is bounded to cross-origin data observable through Autofill, not arbitrary memory reads; no scope change occurs (S:U), meaning the attacker remains confined to the browser process context. The PR:N CVSS metric does not reflect the renderer-compromise dependency - defenders should treat the effective exploitation bar as significantly higher than the base score indicates. |
| Impact | The published CVSS 4.3 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) materially overstates standalone exploitability: the description explicitly requires the attacker to have already compromised the renderer process, a significant prerequisite that PR:N and AC:L do not capture. This discrepancy - a PR:N rating despite an explicit renderer-compromise dependency - should be flagged to defenders relying solely on the base score. The EPSS score of 0.22% (12th percentile) corroborates low real-world exploitation probability. The vulnerability is not listed in CISA KEV and no POC code has been identified. Impact is limited to low confidentiality (C:L) with zero integrity or availability impact. In practice, this is a second-stage attack component: an adversary must first exploit a separate, likely higher-severity Chrome renderer vulnerability before this side-channel becomes reachable. For most organizations, the primary risk driver remains the renderer-level entry point, not this Autofill leak in isolation. |
| Exploit ScenarioDerived | An attacker who has already established code execution within Chrome's renderer process - via a separate, prior renderer vulnerability - crafts a malicious HTML page that triggers the Autofill side-channel. By observing measurable behavioral differences (e.g., timing variations) in the Autofill subsystem while the compromised renderer interacts with cross-origin content, the attacker infers sensitive form field data from other origins loaded in the browser session. No public exploit code for CVE-2026-17851 has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, which contains the vendor-released patch for this vulnerability. The stable channel update is detailed at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Most consumer and enterprise Chrome deployments update automatically; administrators managing fleets should verify all endpoints are running 151.0.7922.72 or later using endpoint management tooling. No documented workaround isolates the Autofill side-channel specifically. Given the renderer-compromise prerequisite, organizations should also prioritize hardening against renderer exploits broadly - for example, enabling Chrome's Enhanced Safe Browsing, enforcing renderer sandbox policies via enterprise policy, and ensuring timely patching of all Chrome releases to reduce the likelihood of the prerequisite renderer compromise being achievable.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Autofill subsystem and is classified under CWE-1300 (Improper Protection of Physical Side Channels). Side-channel attacks exploit observable differences in timing, memory access patterns, or resource consumption rather than direct memory corruption, allowing inference of sensitive data without direct access. In this case, the Autofill feature - which stores and surfaces form field data - leaks cross-origin information through measurable side effects accessible from a compromised renderer context. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* confirms all Chrome builds prior to 151.0.7922.72 are within scope. Chrome's multi-process architecture and site isolation are relevant mitigating structures, but a pre-compromised renderer can still observe side-channel signals across origin boundaries via the Autofill interface.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
AC:H reflects the mandatory renderer-compromise prerequisite; remaining metrics align with the vendor description and published vector.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB