CVE-2026-79288 Overview
CVE-2026-79288 is an improper input validation vulnerability in the Autofill component of Google Chrome on Android. Versions of Chrome prior to 152.0.7977.65 are affected. A remote attacker can obtain sensitive information by luring a user to a crafted HTML page. Chromium engineers rated the security severity as High, and the flaw is tracked under [CWE-20: Improper Input Validation].
The issue impacts the mobile Chrome browser, where Autofill handles form data such as saved addresses, payment details, and credentials. Successful exploitation requires user interaction with an attacker-controlled page.
Critical Impact
A remote attacker can exfiltrate autofilled sensitive data from Chrome on Android by convincing a user to visit a malicious HTML page.
Affected Products
- Google Chrome for Android versions prior to 152.0.7977.65
- Google Android devices running vulnerable Chrome builds
- Chromium-derived mobile browsers that share the affected Autofill code path
Discovery Timeline
- 2026-08-25 - CVE-2026-79288 published to the National Vulnerability Database
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-79288
Vulnerability Analysis
The vulnerability resides in Chrome's Autofill subsystem on Android. Autofill parses HTML form structures to decide which stored user data should populate which fields. Improper input validation in this parsing path allows a crafted page to influence Autofill behavior in ways the browser did not intend.
The result is unintended disclosure of sensitive user data to an origin the user did not authorize. The attack executes remotely over the network and requires the victim to interact with the malicious page, such as tapping a form element. Confidentiality is impacted; integrity and availability are not.
Root Cause
The underlying defect is a failure to properly validate attacker-controlled input processed by the Autofill component. When Autofill evaluates form fields, attributes, or field mappings supplied by a page, insufficient sanity checks let a crafted document manipulate the matching logic. This class of issue is catalogued as [CWE-20].
Attack Vector
Exploitation occurs entirely over the network with no privileges required. The attacker hosts a specially crafted HTML page and drives the victim to it through phishing, malvertising, or a compromised site. When the user interacts with the page and Autofill activates, saved sensitive information can be exposed to the attacker's document. Full technical mechanics are tracked in Chromium Issue #523714535.
No public proof-of-concept exploit code has been released, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-79288
Indicators of Compromise
- Chrome for Android clients reporting a version string earlier than 152.0.7977.65 in browser telemetry or User-Agent logs.
- Outbound requests from mobile browsers to unfamiliar domains immediately after form interaction on unrelated sites.
- User reports of Autofill populating fields on pages where they did not expect stored data to appear.
Detection Strategies
- Inventory managed Android devices and enumerate installed Chrome versions through mobile device management (MDM) or endpoint telemetry.
- Correlate web proxy logs with browser version data to identify sessions where vulnerable Chrome builds interacted with newly registered or low-reputation domains.
- Hunt for phishing pages that mimic login or checkout flows and instrument unusual form field patterns designed to trigger Autofill.
Monitoring Recommendations
- Track Google's Chrome release cadence and alert when managed devices fall behind the current Stable channel.
- Monitor DNS and TLS SNI telemetry for connections to typosquatted or lookalike domains targeted at mobile users.
- Review MDM compliance dashboards for Android devices that have disabled or delayed Play Store application updates.
How to Mitigate CVE-2026-79288
Immediate Actions Required
- Update Google Chrome on Android to version 152.0.7977.65 or later through the Google Play Store.
- Push a policy through MDM to enforce automatic Chrome updates on all managed Android devices.
- Communicate the risk to end users and instruct them to avoid tapping form fields on unfamiliar sites until patched.
Patch Information
Google addressed the issue in the Chrome Stable channel update announced in the Google Chrome Stable Update. Users and administrators should confirm that Chrome for Android reports version 152.0.7977.65 or higher. Additional engineering context is available in Chromium Issue #523714535.
Workarounds
- Temporarily disable Autofill for addresses, payment methods, and passwords in Chrome settings on Android until the update is applied.
- Restrict browsing on unpatched devices to trusted, allow-listed domains via a mobile secure web gateway.
- Enforce Play Store auto-update policies to prevent devices from lingering on outdated Chrome builds.
# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show versionName=152.0.7977.65 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
