CVE-2026-79014 in Chrome
Summary
by MITRE • 08/26/2026
Race condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as CVE-2024-8381 represents a critical race condition within the Autofill subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.65. This flaw stems from improper synchronization mechanisms when handling user input data and form submission events. In modern web browsers, the renderer process is responsible for executing JavaScript and rendering HTML content locally on the client machine. Under normal security models, this environment operates within a strict sandbox to prevent malicious code from accessing sensitive system resources or other browser contexts. However, race conditions occur when two or more processes access shared data concurrently, and the final outcome depends on the precise timing of their execution. In this specific instance, the Autofill feature failed to properly serialize operations related to form field population and validation checks against origin policies. This lack of atomicity created a narrow but exploitable window where an attacker could manipulate the state of the autofill data before security controls were fully applied.
The operational impact of this vulnerability is significant because it allows for a bypass of web origin policies, which are fundamental to the browser's sandboxing architecture. Origin policies restrict how documents or scripts loaded from one origin can interact with resources from another origin, primarily through the Same-Origin Policy (SOP). By exploiting the race condition in Autofill, an attacker who has already compromised the renderer process via a crafted HTML page can extract sensitive information such as saved passwords, credit card numbers, and personal identification details. The attack vector typically involves hosting malicious content that triggers rapid form interactions or automated submissions designed to outpace the security checks implemented by the browser's autofill engine. Once this timing window is exploited, the attacker gains unauthorized access to data that should remain isolated within the user's local storage context, effectively breaking down the boundary between untrusted web content and privileged user credentials stored in the browser profile.
From a classification perspective, this vulnerability aligns with CWE-362, which describes concurrent execution race conditions leading to unintended state changes. The exploitation technique also maps closely to MITRE ATT&CK techniques related to Credential Access via Browser Extensions or Local Input Capture, specifically leveraging legitimate system features like Autofill for malicious data exfiltration. This highlights a broader trend in browser security where complex interactions between different subsystems can introduce subtle logic flaws that are difficult to detect through static analysis alone but are highly effective when exploited dynamically by an attacker with renderer-level access. The severity is rated as High because it directly compromises the confidentiality of sensitive user data and undermines trust in the browser's ability to isolate web content from local secrets.
Mitigation for this vulnerability requires immediate action on two fronts: patching and behavioral monitoring. Users must update Google Chrome to version 152.0.7977.65 or later, where the race condition has been resolved through improved synchronization of autofill operations and stricter validation checks before data retrieval. For organizations managing large fleets of devices, deploying this patch via centralized endpoint management systems is critical to ensure uniform protection against renderer-based attacks. Additionally, security teams should monitor for unusual patterns in network traffic originating from browser processes that might indicate automated form submissions or rapid credential access attempts. While technical controls are the primary defense, user education regarding the risks of visiting untrusted websites remains essential, as initial compromise often relies on social engineering to deliver the crafted HTML payload that triggers this vulnerability.