CVE-2026-110146: Chrome Password Information Disclosure Flaw

CVE-2026-110146 Overview

CVE-2026-110146 is an information disclosure vulnerability in the Passwords component of Google Chrome prior to version 155.0.8059.79. A remote attacker can leverage social engineering to obtain sensitive information from the password manager via a crafted HTML page. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Google rates the Chromium security severity as High, while NVD assigns a medium CVSS score reflecting the required user interaction. Exploitation requires the victim to visit or interact with attacker-controlled content.

Critical Impact
Successful exploitation allows a remote attacker to extract sensitive password-related data from the browser without authentication, bypassing confidentiality boundaries through social engineering.

Affected Products

Google Chrome Desktop versions prior to 155.0.8059.79
Chromium-based browsers that integrate the vulnerable Passwords component
All supported desktop platforms (Windows, macOS, Linux) running pre-patch builds

Discovery Timeline

2026-10-13 - CVE-2026-110146 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-110146

Vulnerability Analysis

The vulnerability resides in the Passwords feature of Google Chrome, which handles stored credentials and autofill logic. A remote attacker who convinces a user to visit a crafted HTML page can trigger conditions that expose sensitive password-related information to attacker-controlled content. The attack vector is network-based and requires user interaction, consistent with a social engineering workflow such as phishing links, deceptive overlays, or spoofed login prompts. No prior authentication or elevated privilege is needed on the target system.

Root Cause

The underlying weakness falls under CWE-200, where the Passwords component improperly exposes data that should remain confined to the browser's trusted boundary. Specific implementation details are not disclosed in the public advisories referenced by the Chromium Issue Tracker #561039723, which remains restricted pending broader patch deployment.

Attack Vector

An attacker hosts a crafted HTML page and lures the victim through phishing or malicious advertising. When the victim interacts with the page, the browser's Passwords logic discloses sensitive information to the attacker's origin. The social engineering requirement makes targeted attacks against high-value users, such as administrators or executives, the most plausible exploitation scenario. See the Google Chrome Stable Update announcement for the vendor's release notes.

No verified proof-of-concept code or technical write-up is publicly available at this time. Refer to the Chromium security advisories for additional context when published.

Detection Methods for CVE-2026-110146

Indicators of Compromise

Browser telemetry showing Chrome versions below 155.0.8059.79 accessing untrusted external pages
Phishing emails or messaging containing links to lookalike login portals or credential-prompt pages
Anomalous outbound requests from browser processes immediately following user navigation to new domains

Detection Strategies

Inventory endpoint browser versions and flag any Chrome install older than 155.0.8059.79
Correlate web proxy logs with threat intelligence feeds to identify known phishing infrastructure
Monitor for user reports of unexpected autofill behavior or password prompts on untrusted sites

Monitoring Recommendations

Enable browser management policies that report installed versions to a central console
Ingest DNS, proxy, and endpoint telemetry into a SIEM for correlation of phishing-driven navigation chains
Alert on repeated access to newly registered or low-reputation domains from managed endpoints

How to Mitigate CVE-2026-110146

Immediate Actions Required

Update Google Chrome to version 155.0.8059.79 or later on all desktop endpoints
Push the update through enterprise management tooling to accelerate rollout across the fleet
Reinforce phishing awareness training with emphasis on inspecting URLs before interacting with login pages

Patch Information

Google released the fix in the Chrome Stable channel update documented in the Chrome Releases blog. Administrators should validate that managed browsers report build 155.0.8059.79 or newer. Chromium-derivative browsers should be updated once their maintainers release corresponding builds.

Workarounds

Restrict use of the browser's built-in password manager in favor of a vetted enterprise password solution until patching is complete
Deploy browser policies that block navigation to known-malicious or newly registered domains
Apply URL filtering and email security controls to reduce exposure to phishing content that would trigger the attack

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Linux
google-chrome --version