CVE-2026-17685: Google Chrome Autofill Use-After-Free Flaw

CVE-2026-17685 Overview

CVE-2026-17685 is a use-after-free vulnerability in the Autofill component of Google Chrome versions prior to 151.0.7922.72. A remote attacker can exploit this flaw by serving a crafted HTML page, triggering memory corruption that leads to arbitrary code execution within the Chrome sandbox. Google rates the Chromium security severity as High. The weakness is classified under CWE-416: Use After Free and affects the renderer process handling of Autofill objects. Successful exploitation gives attackers a foothold inside the sandboxed renderer, which can be chained with a sandbox escape to achieve full system compromise.

Critical Impact
Remote attackers can execute arbitrary code inside the Chrome sandbox by luring a user to a crafted HTML page.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Autofill component
Chrome Stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17685 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17685

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which manages saved form data such as addresses, payment information, and credentials. A use-after-free condition occurs when the Autofill component references a heap object that has already been freed, allowing an attacker-controlled allocation to occupy the freed memory region. When Chrome subsequently dereferences the stale pointer, attacker-supplied data is interpreted as a legitimate object, enabling arbitrary code execution within the renderer process. The Exploit Prediction Scoring System places the current probability of exploitation in the low range, but browser use-after-free bugs are historically favored by exploit developers.

Root Cause

The root cause is improper object lifetime management inside the Autofill code path [CWE-416]. Specific pointers to Autofill objects remain in use after the underlying memory has been released, typically due to asynchronous DOM events or navigation state changes that outrun the lifecycle of the object. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires the victim to load a crafted HTML page in a vulnerable Chrome build. The attacker constructs page content that manipulates Autofill state, such as dynamically created form fields, focus changes, or navigation events, to trigger the dangling pointer condition. Once the freed memory is reclaimed with attacker-controlled data, code execution occurs inside the renderer sandbox. The attacker still needs a separate sandbox escape to reach the host operating system, but the renderer compromise alone exposes cross-origin data and credentials handled by the tab.

No verified proof-of-concept code is publicly available. See the Google Chrome Desktop Update for the vendor's advisory.

Detection Methods for CVE-2026-17685

Indicators of Compromise

Chrome renderer process crashes with signatures referencing Autofill classes or heap-use-after-free faults
Unexpected child process spawning from chrome.exe shortly after browsing untrusted sites
Outbound connections from renderer processes to previously unseen domains hosting crafted HTML
Presence of Chrome builds older than 151.0.7922.72 on managed endpoints

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
Monitor process telemetry for anomalous behavior originating from Chrome renderer processes, including memory allocation spikes and unexpected module loads
Correlate browser crash reports with visits to unfamiliar or newly registered domains

Monitoring Recommendations

Ingest Chrome crash and update telemetry into the security data lake for longitudinal analysis
Alert on Chrome processes writing executables or scripts to disk, which may indicate a chained sandbox escape
Track threat intelligence feeds for public proof-of-concept releases targeting Autofill

How to Mitigate CVE-2026-17685

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all endpoints
Force-restart Chrome after the update so the patched binaries are loaded into memory
Verify enterprise Chrome policies do not defer or block automatic updates
Audit Chromium-derived browsers for equivalent patched releases

Patch Information

Google addressed the vulnerability in the Stable channel release documented in the Google Chrome Desktop Update. The fix is delivered in Chrome 151.0.7922.72 and later. Enterprises using managed distribution should push the update through their standard software deployment tooling.

Workarounds

Disable Autofill for addresses, payment methods, and passwords via enterprise policy until patching is complete
Restrict browsing to trusted sites through web filtering while the update is deployed
Enable Chrome's Enhanced Safe Browsing to increase warnings on suspicious pages

bash

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Disable Autofill via Chrome enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v AutofillAddressEnabled /t REG_DWORD /d 0 /f
reg add "HKLM\Software\Policies\Google\Chrome" /v AutofillCreditCardEnabled /t REG_DWORD /d 0 /f