CVE-2026-79014: Google Chrome Autofill Race Condition

CVE-2026-79014 Overview

CVE-2026-79014 is a race condition vulnerability in the Autofill component of Google Chrome. The flaw affects versions prior to 152.0.7977.65. A remote attacker who has already compromised the renderer process can bypass web origin policy by serving a crafted HTML page. Google has rated this issue as High severity on the Chromium security scale. The weakness is classified under CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization.

Critical Impact
Successful exploitation lets an attacker escape same-origin protections from a compromised renderer, exposing autofill data and cross-origin content to attacker-controlled scripts.

Affected Products

Google Chrome for Desktop versions prior to 152.0.7977.65
Chromium-based browsers that embed the affected Autofill component
Downstream distributions relying on pre-patch Chromium builds

Discovery Timeline

2026-08-25 - CVE-2026-79014 published to the National Vulnerability Database
2026-08-26 - Entry last modified in NVD

Technical Details for CVE-2026-79014

Vulnerability Analysis

The vulnerability resides in the Autofill subsystem of Chrome. Autofill handles form-field data across page contexts and interacts with the renderer process. A race condition in this component allows concurrent operations to observe inconsistent state during origin enforcement checks. An attacker who controls the renderer can time operations against a crafted HTML page to bypass the web origin policy. This bypass breaks the isolation Chrome enforces between different web origins. Google labels the Chromium security severity as High, reflecting the impact on the browser sandbox and origin model.

Root Cause

The root cause is improper synchronization between threads or tasks that share Autofill state during origin validation. Under [CWE-362], the check-and-use sequence is not atomic. A compromised renderer can interleave events so that origin checks pass while the operation targets data belonging to a different origin. This is a classic time-of-check to time-of-use pattern within the Autofill flow.

Attack Vector

Exploitation requires two conditions. First, the attacker must already have compromised the renderer process, typically through a separate memory-safety or logic bug. Second, the attacker delivers a crafted HTML page that triggers the race window in Autofill. Because the pre-condition is renderer compromise, this issue is most valuable as the second stage in an exploit chain that seeks to break out of origin boundaries and reach sensitive cross-site content.

No verified public exploit code is available. Technical detail is tracked in Chromium Issue Tracker #536568319 and the Google Chrome Stable Update announcement.

Detection Methods for CVE-2026-79014

Indicators of Compromise

Chrome processes running versions earlier than 152.0.7977.65 on managed endpoints
Renderer process crashes or unexpected child-process restarts preceding cross-origin data access
Unusual outbound requests carrying form or autofill data to domains that do not match the originating site

Detection Strategies

Inventory installed browser versions across the fleet and flag any Chrome build below 152.0.7977.65
Correlate renderer process anomalies with subsequent network egress to previously unseen domains
Hunt for HTML samples in web proxy logs that repeatedly trigger Autofill APIs across origins

Monitoring Recommendations

Ingest browser version telemetry into a central data lake and alert on outdated Chromium builds
Monitor endpoint process trees for chrome.exe renderer instability paired with unusual DOM or form activity
Track Chromium security advisories and map published fixes to internal patch state

How to Mitigate CVE-2026-79014

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binaries are loaded
Audit third-party Chromium-based browsers and embedded WebView components for equivalent fixes

Patch Information

Google addressed the issue in the stable channel release documented in the Chrome Releases blog. Upgrading to Chrome 152.0.7977.65 or later remediates the race condition in Autofill. Enterprise administrators should validate rollout through their existing browser management channel, such as Chrome Browser Enterprise policies or software distribution tooling.

Workarounds

Disable Autofill for addresses, payment methods, and passwords via enterprise policy where operationally acceptable
Restrict browsing to trusted sites through URL allowlisting until patches are deployed
Enable Site Isolation and enforce enhanced Safe Browsing to reduce the impact of a renderer compromise

bash

# Example: enforce Chrome update and disable Autofill via policy (Linux master_preferences)
{
  "autofill": {
    "credit_card_enabled": false,
    "profile_enabled": false
  },
  "password_manager_enabled": false
}