CVE-2026-17753 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical cross-origin data leakage issue within Google Chrome's Autofill implementation that existed prior to version 151.0.7922.72. The flaw stems from inadequate input validation and sanitization mechanisms within the browser's autofill subsystem, which is designed to automatically populate form fields with previously entered user data. When processing crafted HTML pages, the autofill component failed to properly enforce cross-origin security boundaries, allowing malicious actors to exploit this weakness and extract sensitive information from different origins.
The technical implementation flaw manifests in how Chrome's Autofill service handles cross-origin requests and data isolation. Specifically, the vulnerability occurs when a malicious website loads content from another origin and attempts to trigger autofill functionality that should be restricted by same-origin policies. The system fails to properly validate whether the autofill request originates from an appropriate context, enabling unauthorized access to stored credentials, personal information, or other sensitive data that should remain isolated between different websites.
From an operational impact perspective, this vulnerability poses significant risks to user privacy and security across numerous attack vectors. Attackers could craft malicious web pages that, when visited by users with Chrome browsers, would silently extract autofill data from other domains without user consent. This includes potentially sensitive information such as usernames, passwords, addresses, phone numbers, and other personal details stored in the browser's autofill database. The medium severity classification reflects the potential for data exfiltration and the relative ease of exploitation through standard web-based attack methods.
The vulnerability aligns with CWE-200 (Information Exposure) and potentially relates to ATT&CK technique T1531 (Account Access Removal) through unauthorized data access. It also demonstrates characteristics consistent with cross-site scripting vulnerabilities where proper origin validation fails, and could be exploited in conjunction with other techniques to build more sophisticated attacks. Organizations should prioritize immediate patching of affected Chrome versions and implement network monitoring to detect potential exploitation attempts.
Mitigation strategies include updating to Chrome version 151.0.7922.72 or later where the vulnerability has been addressed through proper cross-origin validation mechanisms. Network administrators should consider implementing web application firewalls that can detect and block suspicious autofill-related requests, while security teams should monitor for anomalous browser behavior indicating potential exploitation attempts. Users should also be educated about the importance of keeping their browsers updated and avoiding untrusted websites that might attempt to exploit such vulnerabilities.