CVE-2026-17730: Google Chrome Autofill Info Disclosure Flaw

CVE-2026-17730 Overview

CVE-2026-17730 is a side-channel information leakage vulnerability in the Autofill component of Google Chrome prior to version 151.0.7922.72. A remote attacker who convinced a user to engage in specific user interface gestures could leak cross-origin data through a crafted HTML page. Google's Chromium security team rated this issue at Medium severity. The weakness is categorized under CWE-1300: Improper Protection of Physical Side Channels, reflecting the observable timing or behavioral discrepancies that enable the leak.

Critical Impact
Cross-origin data belonging to another site can be inferred by an attacker-controlled page after the user performs specific UI gestures, breaking the same-origin protection boundary.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers that incorporate the vulnerable Autofill implementation
Downstream distributions embedding the affected Chromium branch

Discovery Timeline

2026-07-30 - CVE CVE-2026-17730 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17730

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which populates form fields with previously stored user data such as addresses, payment details, and credentials. Autofill operates across origins in specific UI flows and must isolate cross-origin content from observation by the page hosting the form.

This flaw exposes a side channel that allows a malicious page to infer information about cross-origin resources or stored user data. The leakage occurs indirectly through observable behavior rather than through direct read access. Because interaction is required, exploitation depends on convincing the victim to perform specific UI gestures such as clicks or focus changes on a crafted form.

Successful exploitation undermines the browser's cross-origin isolation guarantees. An attacker does not gain code execution but can extract sensitive stored data through repeated measurements.

Root Cause

The root cause is improper protection of a side channel in the Autofill component [CWE-1300]. Timing, rendering, or state-transition differences observable to the embedding page vary based on cross-origin data. This allows an attacker to reconstruct that data without ever violating the same-origin policy at the API level.

Attack Vector

Exploitation requires the attacker to host a crafted HTML page and persuade the victim to visit it. The page must trigger specific UI gestures from the user to activate Autofill behavior that leaks the side-channel signal. Detailed technical information is available in the Chromium Issue Tracker Entry and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-17730

Indicators of Compromise

Chrome browsers reporting a version string earlier than 151.0.7922.72 in user-agent or endpoint inventory data.
Users reporting unexpected Autofill prompts or form population on unfamiliar pages.
Web traffic to unknown domains hosting forms that immediately request focus or click interactions on autofill-eligible fields.

Detection Strategies

Inventory Chrome installations across the fleet and flag any version below 151.0.7922.72 for remediation.
Monitor proxy and DNS logs for outbound connections to newly registered or low-reputation domains delivering HTML forms.
Correlate browser telemetry with user reports of anomalous autofill activity to identify targeted attempts.

Monitoring Recommendations

Ingest browser version telemetry into your SIEM or asset inventory platform to track patch compliance continuously.
Alert on repeated visits to pages containing autofill form controls served from uncategorized domains.
Track help desk tickets referencing unexpected form-fill behavior to surface potential exploitation attempts.

How to Mitigate CVE-2026-17730

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Enable automatic browser updates through enterprise policy to close the patching window.
Communicate to users the risk of interacting with unfamiliar forms and the importance of restarting Chrome to apply updates.

Patch Information

Google addressed CVE-2026-17730 in the Chrome Stable channel release 151.0.7922.72. Users and administrators should verify the running version via chrome://settings/help and force an update where the installed version is older. Refer to the Google Chrome Stable Update advisory for the full list of fixes shipped in this release.

Workarounds

Disable Autofill for addresses, payment methods, and passwords via enterprise policy until the patch is deployed.
Instruct users to avoid interacting with autofill prompts on untrusted or unexpected pages.
Restrict browsing to trusted domains through URL filtering where feasible for high-risk user groups.

bash

# Chrome enterprise policy to disable Autofill until patched (Linux example)
cat <<EOF | sudo tee /etc/opt/chrome/policies/managed/disable_autofill.json
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false
}
EOF