CVE-2026-110146 in Chrome
Summary
by MITRE • 10/13/2026
Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The vulnerability identified as an information leak within the password management subsystem of Google Chrome prior to version 155.0.8059.79 represents a significant compromise in user credential confidentiality. This flaw allows for the unauthorized extraction of sensitive authentication data, specifically stored passwords, through social engineering techniques rather than direct exploitation of code execution vulnerabilities. The severity is classified as High by the Chromium security team, indicating that while remote code execution may not be directly facilitated, the potential impact on individual privacy and organizational security posture is substantial due to the sensitivity of the exposed data class.
The technical nature of this flaw centers around improper handling or exposure mechanisms within the browser's password manager interface or underlying storage layers. When a user interacts with a maliciously crafted HTML page hosted by an attacker, specific conditions are triggered that allow the webpage to access or infer stored credentials without proper authorization checks. This typically involves bypassing same-origin policies or exploiting race conditions in how autofill data is rendered and processed in memory. The attack vector relies heavily on social engineering, requiring the victim to visit a deceptive site designed to trigger this information leakage pathway. Once triggered, the crafted page can extract password strings associated with specific domains or all stored passwords depending on the exact implementation flaw within that browser version.
From an operational impact perspective, the successful exploitation of this vulnerability leads directly to credential theft. Attackers who leverage social engineering to direct users to malicious content can harvest usernames and corresponding plaintext passwords. This compromises not only the integrity of the user's account with Google Chrome but also extends to any other services where password reuse is practiced. The breach undermines trust in the browser as a secure vault for sensitive information, potentially leading to unauthorized access to email accounts, financial platforms, corporate intranets, and personal data repositories. Since the attack requires social engineering, it targets human behavior rather than just software logic, making prevention difficult without user education alongside technical controls.
In terms of industry standards classification, this vulnerability aligns with CWE-200: Information Exposure, specifically falling under categories related to sensitive information leakage through improper access control or interface flaws. It also maps to the MITRE ATT&CK framework technique T1539: Steal Web Session Cookie, although in this context it extends beyond cookies to include stored credentials, and potentially aligns with T1056: Input Capture if keylogging mechanisms are involved, though the primary vector here is data exfiltration via crafted web content. The social engineering aspect connects to TA0001: Initial Access, where attackers use deceptive tactics to gain a foothold or extract valuable intelligence from victims.
Mitigation strategies must address both technical and behavioral aspects of this threat. The most immediate and effective remediation is upgrading Google Chrome to version 155.0.8059.79 or later, which contains the necessary patches to close the information leakage pathway in the password manager. Users should enable automatic updates for their browsers to ensure timely application of security fixes. Additionally, employing multi-factor authentication across all critical accounts reduces the impact even if passwords are compromised via such leaks. Security awareness training is crucial to help users recognize and avoid social engineering attempts that lead to malicious websites designed to exploit browser vulnerabilities. Implementing content security policies and using extensions that restrict cross-origin data access can provide additional layers of defense against crafted HTML pages attempting to harvest sensitive information.