CVE-2026-17851: Google Chrome Autofill Info Disclosure

CVE-2026-17851 Overview

CVE-2026-17851 is a side-channel information leakage vulnerability in the Autofill component of Google Chrome prior to version 151.0.7922.72. A remote attacker who has already compromised the renderer process can leak cross-origin data via a crafted HTML page. The Chromium project rates the security severity as Medium. The weakness is classified under CWE-1300: Improper Protection of Physical Side Channels, reflecting a side-channel disclosure primitive rather than direct memory corruption.

Critical Impact
Attackers with an existing renderer compromise can bypass the same-origin policy through Autofill side channels to read data belonging to other web origins.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Autofill implementation
Chrome Stable channel builds released before the July 2026 desktop update

Discovery Timeline

2026-07-30 - CVE-2026-17851 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17851

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which suggests form values and personal data to users while enforcing origin isolation. The flaw exposes a measurable side channel that reflects state associated with cross-origin resources. An attacker who already controls the renderer process can observe timing, cache, or behavioral differences produced by Autofill operations. These signals allow inference of data that the browser's security model would normally isolate between origins.

Because this is a side-channel disclosure, exploitation does not require memory corruption in Autofill itself. The Chromium security team classified the severity as Medium, reflecting the requirement that the attacker first compromise the renderer through a separate primitive. Chained with a renderer sandbox exploit or a compromised extension, the leak becomes a practical step in a broader cross-origin data theft attack.

Root Cause

The root cause is improper protection of a side channel in the Autofill code path, categorized as CWE-1300. Autofill operations produce observable state differences that correlate with cross-origin data. Additional details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires two conditions. First, the attacker must have already compromised the renderer process, typically through a separate Chrome vulnerability. Second, the attacker delivers a crafted HTML page that triggers Autofill behavior whose side effects can be measured. The renderer then uses those measurements to reconstruct cross-origin values. No verified public exploit code is available. See the Google Blog Chrome Update for the vendor announcement.

Detection Methods for CVE-2026-17851

Indicators of Compromise

Chrome browser processes running versions earlier than 151.0.7922.72 after the vendor patch release
Renderer processes exhibiting anomalous child process spawning or unexpected outbound connections consistent with prior renderer compromise
Crafted HTML pages loading unusual Autofill-triggering form structures from untrusted origins

Detection Strategies

Inventory Chrome and Chromium-based browser versions across endpoints and flag hosts below 151.0.7922.72.
Correlate browser telemetry with renderer sandbox escape indicators, since this bug requires prior renderer compromise to be useful.
Monitor for extensions and web content that repeatedly interact with Autofill APIs across multiple origins in short intervals.

Monitoring Recommendations

Ingest browser process telemetry and endpoint logs into a centralized data lake for version and behavior analytics.
Track Chrome update compliance and alert when endpoints remain on vulnerable builds beyond a defined patch window.
Review web proxy logs for repeated visits to low-reputation domains delivering Autofill-heavy pages.

How to Mitigate CVE-2026-17851

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all desktop endpoints.
Restart browser sessions after patching to ensure the vulnerable renderer code is unloaded.
Audit installed browser extensions and remove those from untrusted publishers that could serve as an initial renderer compromise vector.

Patch Information

Google released the fix in the Chrome Stable channel update announced in the Google Blog Chrome Update. Users should verify their build is at least 151.0.7922.72. Chromium-based browser vendors typically ship the corresponding fix shortly after the upstream release; confirm downstream availability before relying on those builds.

Workarounds

Disable Chrome Autofill for addresses, payment methods, and passwords in enterprise policy until patching is complete.
Enforce Site Isolation and strict extension allowlisting through Chrome Enterprise policy to reduce the likelihood of the prerequisite renderer compromise.
Restrict browsing to trusted origins on high-value workstations through URL filtering while the patch rollout is in progress.

bash

# Configuration example: enforce Chrome update and disable Autofill via enterprise policy (Linux example)
cat >/etc/opt/chrome/policies/managed/cve-2026-17851.json <<'EOF'
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false,
  "ComponentUpdatesEnabled": true,
  "TargetVersionPrefix": "151.0.7922.72"
}
EOF