CVE-2026-17777 in Chrome
Summary
by MITRE • 07/30/2026
Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical cross-origin data leakage issue within Google Chrome's Autofill functionality, specifically affecting versions prior to 151.0.7922.72. The flaw stems from an inadequate implementation of cross-origin isolation controls that should have prevented unauthorized data access between different web origins. The vulnerability manifests when a malicious actor crafts a specially designed HTML page that exploits the Autofill system's improper handling of cross-domain requests, allowing sensitive information to be exfiltrated from one origin to another without proper authorization mechanisms in place.
The technical exploitation occurs through the manipulation of Chrome's Autofill service which is designed to automatically populate form fields with user data. When Chrome processes a crafted HTML page containing malicious elements, the Autofill system fails to properly enforce same-origin policies or cross-origin resource sharing restrictions. This creates an information disclosure channel where data from one web origin can be accessed and potentially leaked to another origin through the Autofill subsystem's handling of form-related requests. The vulnerability specifically targets the boundary conditions within Chrome's security model that should prevent such cross-origin data leakage, particularly when dealing with user input fields and auto-completion features.
The operational impact of this vulnerability extends beyond simple information disclosure as it represents a fundamental breakdown in Chrome's security boundaries for web applications. Attackers could leverage this flaw to access sensitive form data from different origins, potentially compromising user credentials, personal information, or business data stored in forms across multiple websites. The medium severity classification indicates that while the attack vector requires specific conditions and crafting of malicious HTML content, the potential for data exfiltration remains significant enough to warrant immediate attention. This vulnerability directly impacts user privacy and could enable sophisticated phishing attacks or credential theft operations where attackers harvest form data from legitimate web applications.
This security issue aligns with common weakness enumerations such as CWE-200 (Information Exposure) and CWE-352 (Cross-Site Request Forgery) while also mapping to ATT&CK techniques including T1566 (Phishing) and T1071.004 (Application Layer Protocol: DNS). The vulnerability demonstrates the importance of proper origin validation in browser security implementations, particularly for features that handle sensitive user data like form auto-completion. Organizations should prioritize immediate patching of affected Chrome versions to prevent exploitation, while security teams should monitor for indicators of compromise related to suspicious HTML content or unexpected data access patterns.
Mitigation strategies include implementing strict browser updates and maintaining current Chrome versions as specified in the security advisory. Network monitoring solutions should be configured to detect unusual cross-origin requests or data leakage patterns that might indicate exploitation attempts. Additionally, organizations should consider implementing Content Security Policy headers and other web application security controls that can further restrict cross-origin operations within browser environments. Regular security assessments of web applications should include verification that proper origin validation is in place for all form-related functionality, particularly when using browser-based auto-completion features that may be vulnerable to similar cross-origin leakage attacks.