CVE-2026-17731 Overview
CVE-2026-17731 is an inappropriate implementation vulnerability in the Autofill component of Google Chrome on Android. The flaw affects Chrome versions prior to 151.0.7922.72 and allows a remote attacker to leak cross-origin data via a crafted HTML page. Google classifies the Chromium security severity as Medium.
The vulnerability breaks the same-origin protections that Autofill relies on to keep data scoped to its originating site. An attacker who convinces a user to load a malicious page can extract information that should remain isolated to unrelated origins.
Critical Impact
Remote attackers can leak cross-origin data from Chrome for Android through a crafted HTML page, undermining the same-origin isolation model that protects autofilled user data.
Affected Products
- Google Chrome for Android versions prior to 151.0.7922.72
- Chromium-based mobile browsers on Android inheriting the affected Autofill implementation
- Applications embedding vulnerable Chromium Autofill components on Android
Discovery Timeline
- 2026-07-30 - CVE-2026-17731 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-17731
Vulnerability Analysis
The issue resides in Chrome's Autofill subsystem on Android. Autofill is designed to populate form fields with saved data such as addresses, payment details, or contact information, and it must strictly enforce origin boundaries to prevent one site from observing data intended for another.
In affected builds, the Autofill implementation does not correctly enforce those boundaries. A crafted HTML page can influence Autofill behavior in a way that exposes information tied to a different origin. This class of issue is categorized as an Information Disclosure flaw driven by improper input validation and access control within a browser feature.
Google has not published detailed exploitation mechanics. The vendor advisory in the Chrome Releases blog and the corresponding Chromium Issue Tracker entry document the fix without disclosing internal details.
Root Cause
The root cause is an inappropriate implementation within Autofill logic. Origin checks or input handling around form field association fail to prevent a malicious page from triggering behavior that reveals data belonging to an unrelated origin. The defect breaks the trust boundary that Autofill relies on between attacker-controlled DOM structures and stored user data.
Attack Vector
Exploitation requires a user to visit or be redirected to a crafted HTML page in a vulnerable version of Chrome for Android. No authentication is required on the attacker's part. The attack is remote and delivered over the network through normal web browsing.
An attacker can host the crafted page directly, deliver it through phishing, or serve it via a compromised advertising path or embedded iframe on a legitimate site. Refer to the Chromium Issue Tracker entry for reference material.
Detection Methods for CVE-2026-17731
Indicators of Compromise
- Chrome for Android clients reporting versions below 151.0.7922.72 in browser telemetry or user-agent strings
- Unexpected form submissions or Autofill events on pages that do not legitimately request the fields returned
- Outbound requests to unfamiliar domains immediately after Autofill interactions on a page
Detection Strategies
- Inventory mobile endpoints and identify Android devices running Chrome versions prior to 151.0.7922.72.
- Inspect web proxy and DNS logs for repeated visits to pages containing hidden or overlapping form fields tied to unrelated origins.
- Correlate browser version telemetry with phishing report data to prioritize users at elevated risk.
Monitoring Recommendations
- Track Chrome for Android version distribution across managed mobile devices through MDM reporting.
- Alert on visits to newly registered domains that host form-heavy pages targeting authenticated users.
- Monitor user reports of unexpected autofill prompts or data appearing on sites where it was not entered.
How to Mitigate CVE-2026-17731
Immediate Actions Required
- Update Google Chrome on Android to version 151.0.7922.72 or later through the Google Play Store.
- Push the updated Chrome build to managed Android devices using enterprise mobility management policies.
- Advise users to avoid using Autofill on untrusted or unfamiliar sites until patched builds are confirmed installed.
Patch Information
Google released the fix in the Chrome Stable channel update documented in the Chrome Releases announcement. Upgrading Chrome for Android to 151.0.7922.72 or later remediates CVE-2026-17731. Tracking details are available in the Chromium Issue Tracker entry.
Workarounds
- Disable Autofill for addresses, payment methods, and passwords in Chrome for Android settings until the update is applied.
- Restrict browsing on affected devices to trusted destinations and block known phishing infrastructure at the network layer.
- Enforce automatic Chrome updates through Google Play managed configurations to reduce exposure windows for future browser advisories.
# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
