CVE-2026-17880: Google Chrome Autofill Data Leak Flaw

CVE-2026-17880 Overview

CVE-2026-17880 is an inappropriate implementation vulnerability in the Autofill component of Google Chrome. Versions prior to 151.0.7922.72 allow a remote attacker to leak cross-origin data through a crafted HTML page. Google's Chromium security team assigned this issue a Medium severity rating.

The flaw enables a malicious website to bypass the same-origin policy protections that normally isolate data between web origins. Attackers can craft pages that trigger Autofill behavior in ways that expose sensitive information stored or rendered in other origins.

Critical Impact
A remote attacker can leak cross-origin data from a victim's browser by luring the user to a crafted HTML page, undermining a foundational web security boundary.

Affected Products

Google Chrome desktop versions prior to 151.0.7922.72
Chromium-based browsers incorporating the vulnerable Autofill implementation
Downstream distributions that had not integrated the Chromium patch at the time of publication

Discovery Timeline

2026-07-30 - CVE-2026-17880 published to the National Vulnerability Database
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-17880

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which populates form fields with user-saved data such as addresses, payment details, and credentials. An inappropriate implementation permits data associated with one origin to be observed or inferred from a different origin during Autofill interactions.

Cross-origin data leakage in Autofill typically arises when suggestions, field-matching logic, or timing signals fail to enforce origin isolation. The result is an information disclosure primitive usable purely through web content, without native code execution.

Google's advisory does not enumerate the exact exploitation preconditions. The Chromium Issue Tracker entry remains restricted, which is standard practice while patch adoption is ongoing.

Root Cause

The root cause is an inappropriate implementation in Autofill that fails to consistently enforce the same-origin policy when handling autofill data or user interface events. Chrome's Autofill relies on precise separation between the origin that owns saved data and the origin rendering a form. When those boundaries are not maintained, cross-origin observation becomes possible.

Attack Vector

Exploitation requires a remote attacker to serve or inject a crafted HTML page that the victim loads in a vulnerable Chrome build. The attacker's page constructs form structures or triggers Autofill flows designed to expose data belonging to a different origin. No authentication is required, and the attack is delivered over standard web traffic.

Refer to the Google Chrome Stable Update advisory for the vendor's technical description.

Detection Methods for CVE-2026-17880

Indicators of Compromise

Chrome browser versions reporting a build number below 151.0.7922.72 in enterprise inventory data
Outbound connections from user endpoints to unfamiliar domains hosting HTML pages with hidden or off-screen form structures
User reports of unexpected Autofill prompts on sites that should not have access to saved profile or payment data

Detection Strategies

Query endpoint inventory for installed Chrome versions and flag any build predating 151.0.7922.72
Correlate browser telemetry with web proxy logs to identify visits to newly registered or low-reputation domains preceding suspected data disclosure
Monitor for phishing campaigns that pair credential-harvesting lures with links to attacker-controlled HTML pages

Monitoring Recommendations

Track Chrome update compliance across managed fleets and alert on stalled deployments
Ingest browser and proxy logs into a centralized analytics platform to enable retroactive hunting once exploit details become public
Review enterprise Autofill policies and audit which saved profile categories are permitted on managed devices

How to Mitigate CVE-2026-17880

Immediate Actions Required

Update Google Chrome to version 151.0.7922.72 or later on all managed endpoints
Force a browser relaunch after deployment to ensure the patched binary is loaded into active user sessions
Verify update propagation for Chromium-based browsers that inherit the fix from upstream

Patch Information

Google addressed CVE-2026-17880 in the Chrome Stable channel release 151.0.7922.72 for desktop. Full release notes are available in the Google Chrome Stable Update advisory. Administrators using enterprise management tooling should confirm that the update policy targets this build or newer.

Workarounds

Disable Chrome Autofill for addresses, payment methods, and passwords through enterprise policy where immediate patching is not feasible
Restrict browsing to trusted sites via web filtering until the patch is deployed
Educate users to avoid interacting with unsolicited forms or Autofill prompts on unfamiliar pages

bash

# Example Chrome enterprise policy to disable Autofill categories on Linux
# /etc/opt/chrome/policies/managed/disable_autofill.json
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "PasswordManagerEnabled": false
}