Executive brief
A vulnerability in Google Chrome's Autofill feature could allow a malicious website to access data from other websites. This occurs when a user visits a specially crafted page, potentially leading to the unauthorized disclosure of sensitive information stored in the browser. Google has released an update to address this issue.
Technical details
A cross-origin data leak vulnerability exists in the Autofill component of Google Chrome prior to version 151.0.7922.72. The flaw stems from an inappropriate implementation that fails to properly isolate data across different origins during the autofill process. A remote attacker can exploit this by enticing a user to visit a specially crafted HTML page, which could then programmatically trigger or intercept autofill data intended for a different site. This vulnerability is classified by Chromium as Medium severity and has been addressed in the stable channel update for Windows, Mac, and Linux.
Affected products
- Google Chrome prior to 151.0.7922.72
Timeline
- 2026-07-29: patched: Fixed in Chrome version 151.0.7922.72
- 2026-07-30: disclosed: NVD publication date