CVE-2026-17820 in Chrome
Summary
by MITRE • 07/30/2026
Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/30/2026
This vulnerability represents a critical breakdown in Chrome's security model related to its autofill functionality, specifically affecting versions prior to 151.0.7922.72. The flaw stems from inadequate policy enforcement mechanisms that should have prevented unauthorized data leakage between different origins. When users interact with maliciously crafted HTML pages, the browser's autofill system fails to properly isolate data from different security domains, creating a cross-origin information disclosure vector. This issue falls under the broader category of insufficient policy enforcement as defined by CWE-693, which addresses weaknesses in security policy implementation where protective measures are either missing or ineffective.
The technical execution of this vulnerability involves a remote attacker crafting HTML content that exploits Chrome's autofill behavior to access data from different origins without proper authorization. The flaw specifically targets the browser's ability to maintain security boundaries when processing autofill requests across domain boundaries. When Chrome processes autofill operations, it should enforce strict origin-based policies to prevent information leakage, but this enforcement mechanism was insufficient in the affected versions. The vulnerability enables attackers to potentially extract sensitive data that should remain isolated between different web origins.
The operational impact of this vulnerability extends beyond simple data leakage, as it undermines fundamental web security principles and user privacy protections. Users may unknowingly expose personal information, credentials, or other sensitive data when visiting compromised websites that exploit this flaw. The medium severity rating reflects the potential for significant privacy violations and data exposure, particularly in environments where users interact with multiple domains simultaneously. This weakness creates opportunities for attackers to perform cross-site scripting attacks or gather intelligence about user behavior across different web applications.
Organizations and users should implement immediate mitigation strategies including updating Chrome to version 151.0.7922.72 or later, which contains the necessary security patches to address the policy enforcement gaps. Additional protective measures include enabling Chrome's built-in security features such as Site Isolation, using browser extensions that enhance security boundaries, and maintaining awareness of suspicious website behavior. The vulnerability aligns with ATT&CK technique T1566 which covers social engineering attacks through malicious websites, though this particular weakness is more specifically a browser security implementation flaw rather than traditional social engineering. Administrators should also consider implementing network-level monitoring to detect unusual data access patterns that might indicate exploitation attempts.
This vulnerability demonstrates the complexity of modern browser security where seemingly simple features like autofill can create significant attack surfaces if not properly isolated from cross-origin operations. The incident underscores the importance of comprehensive security testing for browser components and highlights the need for robust origin policy enforcement mechanisms. Security teams should also review their incident response procedures to address potential exploitation of similar weaknesses in other browser components or web applications that might exhibit similar policy enforcement failures.