CVE-2026-79030 Overview
CVE-2026-79030 is an information disclosure vulnerability in the Autofill component of Google Chrome versions prior to 152.0.7977.65. The flaw stems from an observable discrepancy [CWE-203] that allows a remote attacker to infer sensitive information through a crafted HTML page. Google's Chromium project classifies the severity as Medium. Exploitation requires user interaction with the malicious page, and the attack complexity is high. No public proof-of-concept or in-the-wild exploitation has been reported.
Critical Impact
A remote attacker can extract sensitive Autofill data from a victim's browser by luring the user to a crafted HTML page that exploits observable behavioral differences in the Autofill component.
Affected Products
- Google Chrome (Desktop) versions prior to 152.0.7977.65
- Chromium-based browsers incorporating the vulnerable Autofill component
- All operating systems supported by Chrome Desktop (Windows, macOS, Linux)
Discovery Timeline
- 2026-08-25 - CVE-2026-79030 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79030
Vulnerability Analysis
The vulnerability resides in Chrome's Autofill subsystem, which stores and injects saved user data such as addresses, payment details, and form values. Autofill exhibits an observable discrepancy [CWE-203] in how it processes or renders form fields depending on stored data. An attacker who crafts a targeted HTML page can measure these differences and infer content the user never intentionally shared.
Observable discrepancy weaknesses fall under the broader category of side-channel information leaks. In this case, the leak channel is the browser's own behavior when handling form structures presented by attacker-controlled markup. The information disclosed is confidential, but integrity and availability are not affected.
Exploitation requires the victim to interact with the attacker's page. The high attack complexity reflects the specific conditions and timing needed to reliably observe the discrepancy and extract data.
Root Cause
The root cause is inconsistent handling within the Autofill component that produces distinguishable behavior tied to the presence, type, or content of saved user data. This behavioral variance forms a side channel from which a remote page can deduce private values that should remain isolated from cross-origin content.
Attack Vector
The attack vector is network-based. An attacker hosts a crafted HTML page and induces the victim to visit it through phishing, malvertising, or a compromised site. The page contains specially structured form elements and observation logic. When the browser processes the page, the discrepancy leaks information the attacker can capture and exfiltrate.
No verified public exploit code exists for this issue. Technical details are tracked in the Chromium Issue Tracker #40057398.
Detection Methods for CVE-2026-79030
Indicators of Compromise
- Browser telemetry showing users on Chrome Desktop versions earlier than 152.0.7977.65
- Access logs indicating visits to pages hosting suspicious form structures combined with heavy client-side timing or DOM inspection scripts
- Outbound requests from browser sessions containing form-field values or fingerprint-like payloads sent to untrusted domains
Detection Strategies
- Inventory endpoints for outdated Chrome installations and flag any build below 152.0.7977.65
- Inspect web proxy logs for repeated visits to newly registered domains that serve HTML with hidden or off-screen form fields
- Correlate browser process events with unusual DOM manipulation followed by outbound HTTPS beacons to non-business domains
Monitoring Recommendations
- Enforce browser version reporting through endpoint management tooling and alert on drift from the patched baseline
- Monitor DNS and HTTP telemetry for connections to known phishing infrastructure that could deliver crafted HTML pages
- Track Autofill-related crash or anomaly reports in Chrome enterprise logs to identify targeted probing
How to Mitigate CVE-2026-79030
Immediate Actions Required
- Update Google Chrome Desktop to version 152.0.7977.65 or later on all managed endpoints
- Force-restart running Chrome sessions after deployment to ensure the patched binary is active
- Audit Chromium-based browsers used in the environment and apply their respective upstream fixes
Patch Information
Google released the fix in the Stable Channel update documented in the Google Chrome Desktop Update. Administrators should deploy Chrome 152.0.7977.65 or newer through their standard software distribution mechanism. Enterprise deployments can use Chrome Browser Cloud Management or group policy to accelerate rollout.
Workarounds
- Disable Chrome Autofill for addresses, payment methods, and passwords via enterprise policy until patching is complete
- Restrict access to untrusted websites through web filtering and DNS security controls
- Train users to avoid interacting with unsolicited links and forms delivered through email or messaging platforms
# Chrome enterprise policy example to disable Autofill until patched
# Windows registry (HKLM\Software\Policies\Google\Chrome)
AutofillAddressEnabled = 0
AutofillCreditCardEnabled = 0
PasswordManagerEnabled = 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
