EUVD-2026-50629
GHSA-235q-px9q-3cqv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryDelivers link via phishing or malvertising
-
ExploitVictim visits page in unpatched Chrome
-
ExecutionPage triggers Autofill cross-origin validation flaw
-
PersistCross-origin data leaked to attacker-controlled script context
-
ImpactAttacker exfiltrates exposed data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 with Autofill enabled (Chrome's default configuration). The attack requires passive user interaction: the victim must navigate to or be redirected to a specially crafted HTML page controlled by the attacker (reflected in UI:R in the CVSS vector). No authentication or special privileges are required from the attacker side (PR:N per CVSS). Exploitation is limited strictly to confidentiality impact - leaking cross-origin data accessible via the Autofill subsystem - with no pathway to integrity modification or availability disruption. The scope of leakable data is constrained to what Autofill exposes in the cross-origin context and does not represent full credential or session theft on its own. The key limiting factors for defenders are the mandatory user-interaction step and the bounded C:L impact ceiling. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N scores 4.3 (Medium), reflecting a network-reachable, low-complexity attack requiring no privileges but mandating user interaction - the victim must visit a crafted page. Impact is bounded to partial confidentiality loss with no integrity or availability effect. EPSS at 0.22% (12th percentile) independently corroborates low exploitation probability in the short term. There is no CISA KEV listing and no publicly known POC, indicating no confirmed active exploitation at time of analysis. The Chromium security team's own rating of 'Medium' aligns with these signals. Taken together, this is a genuine but relatively low-priority finding: the UI:R requirement limits mass automated exploitation, the C:L ceiling caps attacker value, and the low EPSS score reduces urgency compared to high-EPSS Chrome flaws. Real-world risk is most acute for targeted phishing scenarios rather than opportunistic mass exploitation. |
| Exploit ScenarioDerived | An attacker hosts a crafted HTML page that exploits Chrome's Autofill origin validation flaw and delivers a link to a victim via phishing email or malicious advertisement. When the victim opens the link in an unpatched Chrome browser and the page renders, the crafted content triggers the Autofill subsystem to expose cross-origin data to the attacker-controlled page context, which the script can then exfiltrate. No public exploit code is known at time of analysis, making this scenario more theoretical than actively observed. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch addressing this vulnerability per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome's built-in auto-update mechanism should apply this fix automatically for most desktop users; enterprise administrators should verify fleet-wide deployment via Chrome Browser Cloud Management or Group Policy and confirm the installed version through chrome://settings/help. As a compensating control prior to patching, disabling Autofill in Chrome settings (chrome://settings/autofill → turn off 'Save and fill addresses' and 'Save and fill payment methods') eliminates the vulnerable code path at the cost of losing auto-population convenience. Web filtering or proxy controls that block navigation to untrusted or unsolicited HTML pages reduce exposure to the crafted-page delivery vector without requiring configuration changes to Chrome itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's Autofill feature - the browser subsystem responsible for automatically populating form fields with saved user data such as addresses and payment details. CWE-346 (Origin Validation Error) identifies the root cause: Autofill fails to properly validate the requesting origin before making data available to a page, allowing a cross-origin crafted HTML document to read data that the Same-Origin Policy should isolate. The affected scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms prior to 151.0.7922.72, as confirmed by EUVD-2026-50629.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack delivered via crafted webpage (AV:N/AC:L), victim must visit it (UI:R), no attacker privileges needed (PR:N), impact is limited cross-origin data leak only (C:L/I:N/A:N).
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB