EUVD-2026-93623
GHSA-6wch-fg97-vvgv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitPage abuses Autofill authorization flaw
-
ExecutionRead restricted autofill data
-
ImpactExfiltrate sensitive information to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Autofill feature path in Google Chrome for Android (versions prior to 155.0.8059.39) and hinges on an incorrect-authorization condition (CWE-863) that lets an attacker-controlled page access autofill-held data it should not. Limiting factors: the attack requires user interaction (UI:R) - the victim must actively navigate to the attacker's crafted HTML page; it is confined to the Android build of Chrome; and it is fixed in 155.0.8059.39, so patched/auto-updated clients are not affected. Impact is limited to disclosure of sensitive information with no integrity or availability effect per the description. |
| Impact | Signals conflict sharply and must be reconciled before prioritization. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) claims full high confidentiality, integrity AND availability impact, but this directly contradicts both the description - which states only that a remote attacker can 'obtain sensitive information' (a confidentiality-only outcome with no integrity or availability effect) - and Google's own 'Chromium security severity: Low' rating. The C:H/I:H/A:H triad appears to be a generic high-impact template rather than an accurate reflection of this Autofill information-disclosure bug; the real impact is almost certainly confidentiality-only and low. No EPSS score, KEV listing, or POC/exploit-code signal is present in the input, so there is no evidence of active or probable exploitation. Exploitation status: no public exploit identified at time of analysis. Net assessment: despite the headline 8.8, this is a low-real-risk issue - a user-interaction-gated, confidentiality-only autofill leak that the vendor itself rated Low; treat the 8.8 as inflated and prioritize via normal Chrome auto-update rather than emergency patching. Verify the true impact scope with Google before trusting the 8.8 vector. |
| Exploit ScenarioDerived | A remote attacker crafts a malicious HTML page and lures an Android Chrome user (prior to 155.0.8059.39) into visiting it; the page abuses an incorrect-authorization flaw in Chrome's Autofill to read sensitive autofill data the site should not be able to access. No exploit code is known to be public, and success depends on the victim actively loading the attacker's page (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
RemediationAI
Apply the vendor-released patch by upgrading Google Chrome on Android to 155.0.8059.39 or later, which is the fixed version documented in the Chrome stable channel release notes (https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html); on Android this is normally delivered through the Play Store, so confirm Play Store auto-update is enabled and verify the installed build via chrome://version. Because exploitation requires the victim to load a crafted page, updating removes the exposure entirely, but where immediate fleet-wide upgrade is not possible the most direct compensating control is to disable Autofill for addresses and payment methods in Chrome settings, or enforce it via enterprise policy (for example AutofillAddressEnabled and AutofillCreditCardEnabled set to false) or by using an Intune/managed-configuration policy on Android; the trade-off is loss of form-filling convenience and potentially more manual data entry, and it removes the data the bug exposes but does not patch the component, so it should be treated as temporary. Additional hardening while patching progresses: avoid saving payment or address data in Chrome, and refer to the Chromium issue tracker entry (https://issues.chromium.org/issues/552440317) for status; no evidence of active exploitation was identified at time of analysis, but users should not rely on that as a reason to delay the update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an incorrect-authorization defect (CWE-863) in the Autofill component of Google Chrome for Android, the subsystem that stores and programmatically fills user-supplied form data such as addresses, contact details and payment information. Correct authorization here requires that any page able to trigger or influence autofill behavior be validated as the origin legitimately entitled to the data; the flaw lets an attacker-controlled page access autofill-held values it should not be able to reach, which is why the impact class is information disclosure rather than code execution or tampering. The affected CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, is platform-agnostic and therefore over-broad on its own, but the description scopes the defect to the Android build, and EUVD's affected range (Chrome prior to 155.0.8059.39) matches that. The attack vector is network-delivered via a crafted HTML page (AV:N, UI:R, PR:N), meaning no credentials or local access are needed but the victim must visit the attacker's page; the Chromium team rated the bug Low, the referenced Chromium issue 552440317 carries the technical detail, and the Chrome stable channel release notes document the fix.
Know when Android gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Low–High)AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Remote crafted page needs victim navigation (AV:N, UI:R, PR:N); impact is confidentiality-only information disclosure rated Low by the vendor, so C:L, I:N, A:N.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Executive ViewAI
Google Chrome for Android versions before 155.0.8059.39 contain an Autofill information-disclosure issue that could let a crafted webpage access sensitive data stored by the browser. This affects mobile users who rely on Chrome Autofill, potentially including employees accessing corporate services from Android devices; while no public exploit identified at time of analysis and exploitation requires user interaction, the data at risk may include personal or payment details. Leadership should treat this as a manageable but time-sensitive patching priority and reconcile the conflicting severity ratings before final risk acceptance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in A
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly imp
Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android bef
Apktool versions 2.9.1 and prior contain a path traversal vulnerability when processing Android APK files. Malicious APK
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.
The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01
Exploit-DB