CVE-2024-0809: Google Chrome Autofill Bypass Vulnerability

CVE-2024-0809 Overview

CVE-2024-0809 is a medium-severity vulnerability in the Autofill component of Google Chrome versions prior to 121.0.6167.85. The flaw stems from an inappropriate implementation that allows a remote attacker to bypass Autofill restrictions using a crafted HTML page. Exploitation requires user interaction, and the impact is limited to integrity of Autofill data. Google classified the underlying Chromium security severity as Low, while NVD scored it as medium. The vulnerability is tracked under [CWE-693: Protection Mechanism Failure].

Critical Impact
A remote attacker can bypass built-in Autofill safeguards through a crafted web page, potentially inducing users to submit form data they did not intend to share.

Affected Products

Google Chrome versions prior to 121.0.6167.85
Fedora 38
Fedora 39

Discovery Timeline

2024-01-24 - CVE-2024-0809 published to the National Vulnerability Database
2024-01-23 - Google released the Chrome Stable channel update addressing the issue (Chrome Releases)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0809

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which stores and auto-populates user data such as addresses, payment information, and credentials into web forms. Chrome enforces restrictions on when and how Autofill entries can be surfaced to prevent hidden or misleading form fields from harvesting stored data. This inappropriate implementation allows those restrictions to be bypassed when a crafted HTML page is loaded and the user interacts with the page. The result is a protection mechanism failure that erodes the trust boundary between the browser's stored data and untrusted web content. Because attack traffic flows over standard HTTPS to a rendered page, no additional privileges are required beyond convincing the target to visit an attacker-controlled site.

Root Cause

The defect is categorized under [CWE-693: Protection Mechanism Failure]. Chromium's Autofill logic did not correctly enforce the conditions under which suggestions can be applied to form controls. Attackers can shape DOM structure, styling, and event flow to trigger Autofill in contexts that Chrome's safeguards were intended to block. Full technical detail is tracked in the restricted Chromium bug 1497985.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures the user to visit it, typically via phishing, malvertising, or a compromised site. When the user engages with the form, the bypass causes Autofill to populate fields under conditions that the browser should have blocked, leaking stored form data to the attacker-controlled origin. Confidentiality and availability are not directly affected, but integrity of the Autofill workflow is compromised. Consult the Google Chrome Stable Update advisory for the vendor description.

Detection Methods for CVE-2024-0809

Indicators of Compromise

Chrome browser processes running versions earlier than 121.0.6167.85 observed in endpoint inventory data.
Outbound HTTPS submissions from Chrome to newly registered or low-reputation domains shortly after a page load containing hidden or overlaid form fields.
User reports of unexpected pre-filled form data appearing on unfamiliar websites.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any endpoint running a build below 121.0.6167.85.
Correlate web proxy logs with browser telemetry to identify page loads that trigger form submissions containing sensitive Autofill categories such as address or payment fields.
Monitor for phishing pages that clone legitimate checkout or account flows and load in Chrome sessions.

Monitoring Recommendations

Ingest browser version and update-channel telemetry into the SIEM to track patch compliance over time.
Alert on repeated form submissions from a single user to distinct low-reputation domains within short time windows.
Track Fedora dnf update events for the chromium package on Fedora 38 and 39 hosts to confirm patch adoption.

How to Mitigate CVE-2024-0809

Immediate Actions Required

Update Google Chrome to version 121.0.6167.85 or later on all Windows, macOS, and Linux endpoints.
Force a browser restart through management tooling to ensure the patched binary is loaded into memory.
On Fedora 38 and 39, apply the vendor updates referenced in the Fedora package announcements (FEDORA-2024 MMI6GXFONZV6, FEDORA-2024 VXDSGAFQD4BD).

Patch Information

Google addressed the vulnerability in the Stable channel update 121.0.6167.85/.86 for Windows and macOS, and 121.0.6167.85 for Linux. Details are documented in the Google Chrome Stable Update advisory. Fedora shipped corresponding Chromium package updates for supported releases.

Workarounds

Disable Autofill for addresses, payment methods, and passwords through Chrome settings or enterprise policy until patching is complete.
Deploy the AutofillAddressEnabled and AutofillCreditCardEnabled enterprise policies set to false via Group Policy or Chrome Browser Cloud Management.
Restrict browsing to trusted destinations using secure web gateway categories while patch deployment is in progress.

bash

# Configuration example: disable Autofill via Chrome enterprise policy on Linux
sudo tee /etc/opt/chrome/policies/managed/disable_autofill.json > /dev/null <<'EOF'
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false
}
EOF

# Fedora patch application
sudo dnf upgrade --refresh chromium