CVE-2026-84327: Chrome Android Autofill Disclosure Flaw

CVE-2026-84327 Overview

CVE-2026-84327 is an incorrect authorization vulnerability [CWE-863] in the Autofill component of Google Chrome on Android. Versions prior to 152.0.7977.75 fail to properly enforce authorization checks when rendering autofill data on crafted HTML pages. A remote attacker leveraging social engineering can trick a user into interacting with a malicious page to obtain sensitive autofill information. Chromium classifies the security severity as Low, while NVD scores the issue at 6.5 (Medium) reflecting the confidentiality impact when exploitation succeeds. No public proof-of-concept, in-the-wild exploitation, or CISA KEV listing exists at the time of publication.

Critical Impact
Successful exploitation allows a remote attacker to exfiltrate sensitive autofill data such as stored form values from Chrome for Android users who interact with a crafted page.

Affected Products

Google Chrome for Android prior to 152.0.7977.75
Chromium-based mobile browsers inheriting the vulnerable Autofill code path
Android devices running the impacted Chrome Stable channel builds

Discovery Timeline

2026-09-02 - CVE-2026-84327 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84327

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem on Android. Autofill is responsible for populating form fields with stored user data such as addresses, payment details, and other saved values. The component performs an authorization check to decide whether autofill suggestions can be rendered or filled into a given frame or field. That check is incorrectly evaluated when a page is crafted in a specific way, allowing an attacker's page to receive or observe autofill content it should not be authorized to access.

Exploitation requires user interaction, which is why the attack chain relies on social engineering. A victim must be lured to a controlled site and induced to interact with autofill-triggering elements. Once the flawed authorization decision is made, sensitive information stored in the browser profile becomes exposed to the attacker-controlled document context.

Root Cause

The root cause is an incorrect authorization check in the Autofill code path [CWE-863]. The component does not correctly validate the requesting origin or field context before releasing or applying stored data, breaking the trust boundary between the browser's autofill store and untrusted web content.

Attack Vector

The attack vector is network-based and requires user interaction. The attacker hosts a crafted HTML page and drives the victim to it through phishing, malvertising, or similar social engineering. Interaction with fields or scripted elements on the page triggers the flawed authorization path, causing Chrome to expose sensitive autofill data to the attacker's document. See the Chromium Issue Tracker #498725213 and the Google Chrome Stable Channel Update for vendor detail.

Detection Methods for CVE-2026-84327

Indicators of Compromise

Chrome for Android clients reporting a version string earlier than 152.0.7977.75 in user-agent telemetry or MDM inventory
Outbound HTTP/S traffic from mobile endpoints to newly registered domains hosting form-heavy landing pages linked from phishing lures
User reports of unexpected autofill prompts or pre-populated fields on unfamiliar sites

Detection Strategies

Inventory Android endpoints against installed Chrome versions and flag any build older than 152.0.7977.75
Correlate mobile web-proxy logs with phishing indicators to surface likely social-engineering delivery infrastructure
Monitor email and messaging gateways for links leading to pages that heavily reference autofill form fields or hidden inputs

Monitoring Recommendations

Enable centralized logging of mobile browser versions through enterprise mobility management (EMM/MDM) reporting
Ingest URL and DNS telemetry from mobile devices into a SIEM or data lake for correlation against known phishing feeds
Alert on repeat user reports of anomalous autofill behavior to identify emerging campaigns targeting the flaw

How to Mitigate CVE-2026-84327

Immediate Actions Required

Update Google Chrome on Android to version 152.0.7977.75 or later through the Google Play Store
Push the update via mobile device management to enforce compliance across managed fleets
Reinforce user awareness on avoiding untrusted links, particularly those requesting form interaction

Patch Information

Google addressed the issue in Chrome 152.0.7977.75 for Android via the Stable Channel update. Details are published in the Google Chrome Stable Channel Update and tracked in Chromium Issue #498725213. Applying the vendor patch is the definitive remediation.

Workarounds

Disable autofill for addresses, payment methods, and passwords in Chrome settings until the update is applied
Restrict browsing on high-risk mobile devices to allow-listed corporate domains via MDM web filtering
Route mobile web traffic through an inspecting secure web gateway to block known phishing infrastructure

bash

# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=152.0.7977.75 or later