Executive brief
A vulnerability in Google Chrome's Autofill feature could allow a malicious website to access data from other websites. This occurs when a user visits a specially crafted webpage, potentially leading to the unauthorized disclosure of sensitive information. Users are advised to update to the latest version of Chrome to mitigate this risk.
Technical details
An inappropriate implementation vulnerability exists in the Autofill component of Google Chrome. A remote attacker can exploit this by enticing a user to visit a specifically crafted HTML page. Successful exploitation allows the attacker to bypass cross-origin isolation and leak data from different origins. The vulnerability is addressed in Chrome version 149.0.7827.53 and later. Google has classified this with a 'Low' severity rating.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-05: disclosed: NVD publication date