CVE-2026-17820: Google Chrome Autofill Leak Vulnerability

CVE-2026-17820 Overview

CVE-2026-17820 is an insufficient policy enforcement vulnerability in the Autofill component of Google Chrome versions prior to 151.0.7922.72. A remote attacker can leak cross-origin data by convincing a user to visit a crafted HTML page. The Chromium project rated this issue as Medium severity.

The flaw undermines the same-origin policy that Autofill is expected to enforce. As a result, data intended for one origin can be exposed to attacker-controlled contexts, enabling information disclosure without any privileged access.

Critical Impact
Remote attackers can leak cross-origin data from Autofill by serving a crafted HTML page to a user running an unpatched Chrome build.

Affected Products

Google Chrome versions prior to 151.0.7922.72
Chromium-based browsers embedding vulnerable Autofill code paths
Desktop Chrome Stable channel builds released before the July 2026 update

Discovery Timeline

2026-07-30 - CVE-2026-17820 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17820

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which handles suggested completions for forms, addresses, payment methods, and similar fields. Insufficient policy enforcement means Autofill fails to correctly restrict data flow between origins under specific page constructions.

A remote attacker can craft an HTML page that manipulates Autofill behavior to observe or receive values that originate from a different origin. This constitutes a cross-origin information disclosure. The Chromium security team classified the underlying severity as Medium, reflecting information leakage rather than code execution.

Because exploitation requires only that a victim load an attacker-controlled page, standard drive-by delivery mechanisms apply. The attack does not require user interaction beyond page navigation and does not require authentication to the targeted origin.

Root Cause

The defect stems from missing or incomplete origin checks in the Autofill flow. When Autofill logic evaluates whether stored data should be surfaced to a rendered form, the policy decision does not fully account for the origin boundary of the containing frame or the requesting field. See the Chromium Issue Tracker Entry for upstream tracking.

Attack Vector

Exploitation proceeds over the network. The attacker hosts a crafted HTML page, then lures the victim to load it in a vulnerable Chrome build. The page constructs form elements or frames that trigger Autofill under attacker-controlled conditions. Data pulled by Autofill from a foreign origin becomes readable by the attacker's page, enabling exfiltration. Refer to the Google Chrome Stable Update announcement for release context.

No verified proof-of-concept code has been published. Technical specifics beyond the vendor advisory remain restricted while patched builds are rolled out.

Detection Methods for CVE-2026-17820

Indicators of Compromise

Chrome browser processes reporting a version string below 151.0.7922.72 in endpoint inventory data
Outbound HTTP(S) requests from browsers to unfamiliar domains immediately following form rendering events
Web page loads containing hidden or unusually structured form fields that trigger Autofill without user focus

Detection Strategies

Inventory browser versions across managed endpoints and flag Chrome installations below 151.0.7922.72.
Correlate proxy logs for suspicious POST or GET requests that carry field values shortly after page load from newly seen domains.
Hunt for anomalous DOM constructs in proxied HTML content, such as invisible payment or address forms rendered by unknown origins.

Monitoring Recommendations

Enable browser telemetry forwarding to a central log store and track Chrome version drift over time.
Monitor secure web gateway categorizations for uncategorized or newly registered domains hosting HTML with form-heavy structures.
Alert on user reports of unexpected Autofill prompts, which can indicate probing pages in the wild.

How to Mitigate CVE-2026-17820

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints.
Restart Chrome processes after the update to ensure the patched binary is loaded.
Verify Chromium-based third-party browsers have picked up the corresponding upstream fix.

Patch Information

Google addressed CVE-2026-17820 in Chrome Stable 151.0.7922.72. Deployment details are documented in the Google Chrome Stable Update release notes. Enterprises should push the update through their standard browser management channel and confirm rollout completion via version telemetry.

Workarounds

Disable Autofill for addresses, payment methods, and passwords via enterprise policy until patch deployment is verified.
Restrict browsing to trusted categories using a secure web gateway to reduce exposure to crafted pages.
Enforce Chrome auto-update policies so future stable-channel fixes deploy without manual intervention.

bash

# Configuration example: disable Autofill via Chrome enterprise policy (Linux)
sudo tee /etc/opt/chrome/policies/managed/disable_autofill.json >/dev/null <<'EOF'
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false
}
EOF