CVE-2026-79288 in Chrome
Summary
by MITRE • 08/26/2026
Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an improper input validation flaw within the Autofill component of Google Chrome on Android, specifically in versions prior to 152.0.7977.65, represents a significant risk to user privacy and data integrity. This security issue stems from insufficient sanitization or type-checking mechanisms when processing form data submitted through web pages. The Autofill feature is designed to assist users by automatically populating fields with previously entered information such as names, addresses, credit card numbers, and other personal identifiers. When the browser fails to properly validate inputs before rendering them in these autofilled contexts, it creates an avenue for malicious actors to exploit this trust relationship between the user interface and the underlying data storage mechanisms.
A remote attacker can leverage this vulnerability by constructing a specially crafted HTML page that contains deceptive form elements designed to trigger the Autofill functionality improperly. By embedding specific input fields or manipulating existing forms with carefully encoded payloads, the attacker forces the browser's autofill engine to process sensitive information in an unintended manner. This misconfiguration allows the malicious script to intercept, extract, or exfiltrate data that was intended for legitimate form submissions but is instead exposed through the flawed rendering logic. The severity of this issue is classified as High by the Chromium security team because it directly compromises confidential user data without requiring any physical access or prior authentication on the target device beyond visiting a malicious website.
The operational impact of this vulnerability extends beyond simple data leakage, potentially facilitating broader attacks such as identity theft, financial fraud, and unauthorized account takeovers. Since Autofill often handles highly sensitive credentials like payment details and login information, an attacker who successfully exploits this flaw can harvest these values in plaintext or through manipulated DOM structures that bypass standard security boundaries. This capability aligns with the ATT&CK technique of Credential Access via Browser Extension or Input Capture, where attackers use web-based methods to steal user credentials. Furthermore, it relates closely to CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if sensitive data is exposed through misconfigured default values or cached autofill entries that are not properly isolated from malicious scripts.
Mitigation strategies primarily involve updating the Google Chrome application on Android devices to version 152.0.7977.65 or later, where these input validation checks have been strengthened and corrected by the Chromium development team. Users should ensure automatic updates are enabled to receive security patches promptly as they become available. Additionally, adopting defensive browsing practices such as disabling Autofill for sensitive fields like credit card numbers can reduce the attack surface. Security professionals monitoring enterprise environments should verify that endpoint management solutions enforce browser version compliance policies and consider deploying content security policies or script blockers in high-risk scenarios where users may be exposed to untrusted web content. Regular audits of third-party extensions installed on Chrome browsers are also recommended, as they could potentially interact with autofill data if the core vulnerability is not fully mitigated by updates alone.