CVE-2026-106212 in Chrome
Summary
by MITRE • 10/06/2026
Incorrect authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified as an incorrect authorization flaw within the Autofill feature of Google Chrome prior to version 155.0.8059.39 represents a significant breach in user data confidentiality, specifically targeting sensitive personal information such as addresses, credit card numbers, and passwords stored by the browser for convenience. This security severity is classified as Medium under Chromium’s internal scoring system, reflecting its potential impact on individual privacy rather than immediate system compromise or remote code execution. The core technical flaw lies in how the Autofill subsystem handles access control when interacting with web pages that request autofill data. In a properly secured environment, browsers enforce strict same-origin policies and explicit user consent mechanisms to ensure that sensitive form fields are only populated by trusted origins or after direct user interaction. However, in this specific instance, the authorization logic failed to adequately validate whether the requesting HTML page had legitimate permission to access the stored autofill data, particularly when the request was initiated through crafted web content designed to mimic legitimate interactions.
The operational impact of this vulnerability is primarily driven by social engineering tactics rather than purely technical exploitation vectors like buffer overflows or injection attacks. A remote attacker can host a malicious webpage containing specially constructed HTML and JavaScript code that attempts to trigger autofill behavior on sensitive input fields such as login forms or payment sections. Because the browser’s authorization check was insufficient, it may automatically populate these fields with the user’s stored credentials or financial details without requiring explicit confirmation from the end-user in certain contexts. This allows an attacker to passively harvest highly sensitive information simply by convincing a victim to visit the crafted page. The success of this attack relies heavily on the victim having previously saved autofill data and being tricked into interacting with the malicious site, making it a classic example of how browser features intended for usability can be weaponized if access controls are not rigorously enforced.
From an industry standards perspective, this vulnerability aligns closely with CWE-269, which describes Improper Authorization, where a user is able to access or perform actions that they should not have permission to do due to flawed logic in the application’s security checks. It also relates to CWE-359, Exposed Private Information, as the result of the exploit is the unauthorized disclosure of private data stored locally on the client machine. In terms of the MITRE ATT&CK framework for enterprise and browser-based threats, this behavior maps to techniques involving Data from Local System Retrieval or potentially Credential Access via Browser Harvesting if passwords are involved. The attack vector falls under Social Engineering because it requires user interaction with a malicious site, distinguishing it from more automated remote code execution vulnerabilities that require no user action beyond visiting a page.
Mitigation for this vulnerability is primarily addressed through the software update to Google Chrome version 155.0.8059.39 or later, which corrects the authorization logic within the Autofill subsystem to ensure stricter validation of origin permissions and request contexts before populating sensitive fields. For organizations managing fleets of browsers, ensuring automatic updates are enabled is critical to maintaining this protection layer. Additionally, users can mitigate risk by regularly reviewing saved autofill data in browser settings and removing any entries that are no longer necessary or trusted. Enabling enhanced security modes such as Enhanced Protection in Chrome’s Safe Browsing features can also provide additional layers of detection against malicious sites attempting to exploit these types of client-side vulnerabilities. Ultimately, while technical patches resolve the code-level flaw, user awareness regarding social engineering remains a vital component of defense-in-depth strategies for preventing data exfiltration via browser-based attacks.