CVE-2026-87478: Google Chrome Autofill Information Disclosure

CVE-2026-87478 Overview

CVE-2026-87478 is an observable discrepancy vulnerability in the Autofill component of Google Chrome versions prior to 153.0.8010.36. A remote attacker can obtain sensitive information by delivering a crafted HTML page to a targeted user. The flaw is categorized under [CWE-203: Observable Discrepancy], which allows an attacker to infer protected data based on differences in application behavior. Google classifies the Chromium security severity as Medium. Successful exploitation requires user interaction, such as visiting a malicious website. The vulnerability affects the desktop Stable channel of Chrome and was addressed in the Stable Channel Update published by Google.

Critical Impact
Remote attackers can extract sensitive autofill data, including stored form values, by leveraging observable behavioral differences in Chrome's Autofill component through a crafted webpage.

Affected Products

Google Chrome desktop versions prior to 153.0.8010.36
Chromium-based browsers sharing the affected Autofill implementation
All operating systems where the vulnerable Chrome Stable channel is deployed

Discovery Timeline

2026-09-09 - CVE-2026-87478 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-87478

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill component, which stores and populates form fields with user-provided values such as addresses, phone numbers, and payment metadata. An observable discrepancy allows a remote attacker to distinguish between different internal states of the browser by measuring side-effects of Autofill operations. The attacker delivers a crafted HTML page that triggers Autofill behavior and observes the resulting differences to infer stored values. Because the attack occurs entirely within the browser rendering context, it does not require any privileges on the target system. However, the victim must interact with the malicious page for exploitation to succeed.

Root Cause

The root cause is an information leak through observable behavioral differences [CWE-203] in the Autofill code path. The component exposes side-effects, such as timing, layout changes, or DOM state transitions, that vary based on whether specific stored data is present. An attacker measures these differences from JavaScript running on an attacker-controlled page. This class of flaw is a side-channel disclosure rather than a memory-safety issue.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page and lures the victim to visit it through phishing, malvertising, or a compromised website. Once the page loads, embedded scripts probe the Autofill component and read the observable discrepancies. Confidentiality is impacted, while integrity and availability of the browser are not. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability manifests in the Autofill logic; see the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-87478

Indicators of Compromise

Chrome desktop clients reporting a version string below 153.0.8010.36 in browser telemetry or user-agent logs.
Outbound connections to unfamiliar domains immediately after form rendering events, which may indicate exfiltration of autofilled data.
HTML pages containing hidden or off-screen form fields designed to trigger Autofill without visible user consent.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any host running a build older than 153.0.8010.36.
Inspect proxy and web gateway logs for HTML pages containing high densities of hidden form inputs paired with rapid script execution.
Correlate browser process telemetry with DNS and HTTP egress to identify anomalous data flows following page loads.

Monitoring Recommendations

Enable browser management policies that report Chrome version and update status to centralized logging.
Monitor for phishing campaigns delivering links to unknown domains, which are the primary delivery mechanism for this attack.
Track user-reported Autofill anomalies, such as unexpected form population, as potential exploitation indicators.

How to Mitigate CVE-2026-87478

Immediate Actions Required

Update Google Chrome to version 153.0.8010.36 or later on all managed desktop endpoints.
Force browser restarts through endpoint management tooling to ensure the patched binary is loaded.
Validate the deployed Chrome version by reviewing chrome://version or equivalent enterprise reporting.

Patch Information

Google addressed CVE-2026-87478 in the Chrome Stable channel release documented in the Google Chrome Stable Update. The fix is included in Chrome 153.0.8010.36 and later builds. Enterprises using Chrome Browser Cloud Management or Group Policy should confirm that automatic updates are enabled and unblocked by network filtering.

Workarounds

Disable Autofill for addresses and payment methods through the AutofillAddressEnabled and AutofillCreditCardEnabled enterprise policies until the patch is deployed.
Restrict browsing to trusted sites using web filtering to reduce exposure to crafted HTML pages.
Educate users to avoid clicking untrusted links, since exploitation requires visiting an attacker-controlled page.

bash

# Configuration example: disable Autofill via Chrome enterprise policy (Linux managed policy JSON)
cat > /etc/opt/chrome/policies/managed/disable_autofill.json <<'EOF'
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false
}
EOF