CVE-2026-17777: Chrome Autofill Data Leak Vulnerability

CVE-2026-17777 Overview

CVE-2026-17777 is an inappropriate implementation flaw in the Autofill component of Google Chrome prior to version 151.0.7922.72. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. The Chromium project rates this issue as Medium severity. The flaw undermines the same-origin policy, which is a foundational browser security boundary designed to prevent one origin from reading data belonging to another.

Critical Impact
Remote attackers can exfiltrate cross-origin data from Autofill through a crafted web page, bypassing the browser's same-origin isolation guarantees.

Affected Products

Google Chrome Desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the affected Autofill component
All supported desktop platforms (Windows, macOS, Linux) running vulnerable Chrome builds

Discovery Timeline

2026-07-30 - CVE-2026-17777 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17777

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill feature, which stores and injects user-provided data such as addresses, payment information, and form values. An inappropriate implementation in this component allows a malicious HTML page to observe or extract data that belongs to a different origin. This violates the browser's cross-origin isolation model, exposing information that should remain private to the originating site.

Cross-origin data leaks in Autofill typically arise when form field state, suggestion behavior, or DOM interactions expose observable side effects that an attacker-controlled page can measure. The result is unauthorized disclosure of sensitive user information without direct user interaction with the target origin.

Root Cause

The root cause is an implementation defect in the Autofill subsystem that fails to enforce origin boundaries when handling form data or suggestion logic. Details are tracked in the Chromium Issue Tracker Entry. Because Chromium restricts access to security-sensitive bug reports until fixes propagate downstream, deeper technical specifics remain restricted.

Attack Vector

Exploitation requires a user to visit a crafted HTML page hosted by the attacker or delivered through a compromised site, advertisement, or iframe. No authentication is required, and the attack is remote. The crafted page interacts with Autofill in a way that causes cross-origin data to become observable to attacker-controlled script.

The vulnerability is described in prose only; no public proof-of-concept is available at this time. Refer to the Google Chrome Desktop Update for the vendor's disclosure summary.

Detection Methods for CVE-2026-17777

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 on endpoints handling sensitive data
Outbound connections from browser processes to newly registered or low-reputation domains shortly after form interactions
Unexpected script activity on pages that embed third-party iframes interacting with Autofill

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build below 151.0.7922.72
Correlate browser telemetry with web proxy logs to identify sessions that load attacker-controlled pages performing repeated form field probing
Alert on browser child process behavior that deviates from established baselines, including anomalous cross-origin resource requests

Monitoring Recommendations

Ingest browser version and patch-state telemetry into a centralized data lake for continuous compliance reporting
Monitor DNS and HTTP telemetry for known malvertising and phishing infrastructure that may host crafted pages
Track user reports of unexpected Autofill suggestions or leaked personal data as a behavioral signal

How to Mitigate CVE-2026-17777

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force-restart Chrome after update deployment to ensure the patched binary is loaded into memory
Verify that enterprise auto-update policies are not blocking the stable channel release

Patch Information

Google addressed CVE-2026-17777 in the stable channel release documented in the Google Chrome Desktop Update. Upgrading to Chrome 151.0.7922.72 or later remediates the flaw. Chromium-based browsers should apply the corresponding upstream fix once vendors publish updated builds.

Workarounds

Disable Autofill for addresses and payment methods through enterprise policy where business requirements permit
Restrict browsing to trusted sites via web filtering until patches are deployed across the environment
Educate users to avoid entering sensitive form data on untrusted pages until remediation is confirmed

bash

# Enterprise policy example: disable Autofill via Chrome policy on Linux
# /etc/opt/chrome/policies/managed/disable_autofill.json
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false
}