CVE-2026-84327 in Chrome
Summary
by MITRE • 09/02/2026
Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/02/2026
The vulnerability identified as an incorrect authorization flaw within the Autofill feature of Google Chrome on Android, specifically in versions prior to 152.0.7977.75, represents a significant breach of user data confidentiality through social engineering vectors. This issue stems from a failure in the browser's internal access control mechanisms when handling sensitive form fields such as passwords, credit card numbers, or personal identification information. The core technical flaw lies in how the Autofill subsystem validates the context and origin of requests for autofilled data. In vulnerable versions, the security boundary between different web origins was not strictly enforced during the retrieval process, allowing a malicious webpage to programmatically trigger the extraction of stored credentials without explicit user consent or proper authorization checks. This misconfiguration effectively bypasses the intended isolation model that prevents cross-origin data leakage, creating an avenue for unauthorized access to highly sensitive user information.
The operational impact of this vulnerability is primarily driven by its reliance on social engineering rather than a purely technical exploit chain. A remote attacker does not need to compromise the underlying operating system or browser engine directly; instead, they craft a deceptive HTML page designed to trick the user into interacting with it in a way that triggers the autofill mechanism. For instance, an attacker might host a phishing site that mimics a legitimate service and includes hidden form fields configured to request specific types of data from Chrome's Autofill database. When an unsuspecting victim visits this crafted page while logged into their browser or having previously saved credentials, the malicious script can exploit the authorization flaw to retrieve these details. The severity is classified as Low by Chromium security standards because it requires user interaction and social engineering success, but the potential for data theft remains high given that autofill often contains multiple years of sensitive personal and financial history.
From a classification perspective, this vulnerability aligns with CWE-269, which denotes Improper Authorization, specifically in contexts where access control decisions are not enforced correctly against untrusted input or external actors. Furthermore, the attack vector corresponds to techniques found in the MITRE ATT&CK framework under T1059, Command and Scripting Interpreter, as well as aspects of data exfiltration via web browsers. The exploitation method leverages standard HTML and JavaScript capabilities combined with browser-specific APIs that were improperly secured. This highlights a critical intersection between application logic errors and user behavior manipulation, where the technical flaw serves only to enable what would otherwise be impossible without direct access to local storage or memory dumps.
Mitigation for this vulnerability requires immediate action by users running affected versions of Google Chrome on Android devices. The primary remediation is to update the browser to version 152.0.7977.75 or later, where the authorization checks within the Autofill subsystem have been corrected to ensure that data retrieval requests are properly validated against strict origin policies and user consent requirements. In addition to updating software, users should exercise heightened caution when visiting unfamiliar websites, particularly those requesting login credentials or payment information. Enabling two-factor authentication on all critical accounts provides a secondary layer of defense, ensuring that even if sensitive data is exfiltrated via this vulnerability, the attacker cannot easily compromise associated services without additional verification steps. Regularly reviewing saved passwords and autofill entries in Chrome settings can also help minimize the exposure surface by removing outdated or unnecessary credentials from local storage.