Google Chrome EUVD-2026-50726

Exploitation requires the victim to be running Google Chrome prior to version 151.0.7922.72 with the Autofill feature enabled, which is the default Chrome configuration. The CVSS vector confirms UI:R - the victim must actively navigate to the attacker's crafted HTML page; exploitation cannot occur passively or server-side. PR:N confirms no attacker authentication is required. Exploitation is limited by: (1) mandatory user interaction to visit the malicious page, restricting the attack to social-engineering delivery vectors; (2) confidentiality impact scoped to low (C:L), meaning only partial data is accessible rather than full session or credential extraction; (3) no integrity or availability impact, ruling out code execution. The specific autofill data categories accessible (addresses, payment cards, credentials) are not confirmed from public sources - Chromium issue 513462236 is the authoritative reference but is not publicly disclosed.

The CVSS 4.3 Medium score (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) accurately reflects the threat profile: remotely exploitable with low complexity but gated behind mandatory user interaction, with only partial confidentiality impact and no integrity or availability component. EPSS at 0.21% in the 11th percentile strongly corroborates low observed exploitation probability. There is no CISA KEV entry and no identified public POC, reinforcing that this is not a weaponized vulnerability. The realistic risk is targeted data harvesting - an attacker who can lure a specific high-value user to a crafted page may extract autofill-stored credentials or payment data. For most enterprise environments this is a patch-and-monitor issue, not an emergency response item. The main limiting signal missing from available intelligence is the exact categories of autofill data accessible; Chromium issue 513462236 would clarify this but is not publicly accessible at time of analysis.

An attacker registers a domain and hosts a specially crafted HTML page designed to invoke Chrome's Autofill in a cross-origin context, then delivers the link to a target via a phishing email or malicious advertisement. When the victim clicks the link and the page loads in an unpatched Chrome, the Autofill origin validation flaw causes the browser to expose data (such as stored address or payment fields) associated with a trusted origin to the attacker-controlled page. No public POC exists at time of analysis, so exploitation would currently require independent discovery of the triggering HTML pattern.