Google Chrome Android EUVD-2026-65786

The victim must be using Google Chrome on Android at a version prior to 152.0.7977.65. The attack requires user interaction: the victim must navigate to or be redirected to a crafted HTML page (UI:R per CVSS vector). No authentication or special permissions are required of the attacker. The vulnerability is specific to the Android platform's Autofill implementation; desktop Chrome is not implicated by this CVE. Exploitation is limited to data that the user has stored in Chrome Autofill on that device; users who have not saved form or credential data in Chrome Autofill would have reduced or no data exposed. No special server-side configuration of the victim's environment is required.

The CVSS 6.5 score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N indicates a network-exploitable, low-complexity flaw requiring no authentication but requiring user interaction - a meaningful friction point. The high confidentiality impact is the primary driver of the score; there is no integrity or availability impact. Against these metrics, the EPSS score of 0.22% at the 13th percentile reflects very low observed exploitation probability, and the absence of a CISA KEV listing further confirms no confirmed active exploitation at time of analysis. No public proof-of-concept code is referenced in the intelligence sources. The realistic threat model is a targeted phishing scenario rather than mass exploitation: an attacker must convince a Chrome-for-Android user to visit a crafted page, and the payoff depends on what Autofill data is populated for that user. A patch is available and Chrome's auto-update mechanism substantially reduces the exposure window for most users. Priority should be elevated for organizations whose Android users store sensitive credentials in Chrome Autofill without enterprise MDM enforcement of browser update policies, but this is not a broad emergency for fully-patched fleets.

An attacker registers or compromises a web domain and serves a crafted HTML page containing form elements or JavaScript designed to trigger Chrome's Autofill subsystem in an unexpected way. A Chrome-for-Android user is directed to this page via phishing email, SMS, or malicious advertisement. Upon page load and any user interaction that triggers Autofill, the improper input validation flaw causes the browser to expose saved Autofill data - such as names, addresses, email addresses, or payment information - to the attacker-controlled page.