CVE-2026-87478 in Chrome
Summary
by MITRE • 09/09/2026
Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified as an observable discrepancy in the autofill functionality of Google Chrome, specifically affecting versions prior to 153.0.8010.36, represents a significant privacy and data leakage risk for end users. This flaw stems from improper handling or exposure of sensitive user input data within the browser's autocomplete mechanisms. When a remote attacker constructs a malicious HTML page designed to interact with these autofill fields, they can exploit this discrepancy to extract information that was intended to remain private or obscured by default security settings. The severity is classified as medium because while it does not typically allow for direct code execution or full system compromise, the unauthorized access to sensitive personal data constitutes a serious breach of user confidentiality and trust in the browser's integrity.
From a technical perspective, this issue aligns with CWE-200, which categorizes information exposure vulnerabilities where an attacker gains insight into internal state or private data that should not be accessible. The attack vector relies on social engineering combined with technical exploitation, as the victim must visit a crafted webpage to trigger the leakage. This scenario is consistent with ATT&CK technique T1539, which involves stealing web session credentials through autofill manipulation. By crafting an HTML page that mimics legitimate login forms or input fields, the attacker can trick the browser into revealing previously saved passwords, credit card numbers, addresses, or other personally identifiable information stored in Chrome's password manager or address book. The observable nature of this discrepancy suggests that the leaked data might be visible in plain text within the DOM or accessible via JavaScript APIs intended for form validation but misconfigured to expose sensitive values rather than masked placeholders.
The operational impact of this vulnerability is primarily centered on privacy violations and potential downstream security risks such as account takeover, identity theft, or financial fraud. Users who rely heavily on Chrome's autofill features for convenience are at heightened risk, as the browser automatically populates fields with stored credentials without requiring explicit user interaction beyond visiting a malicious site. This undermines the fundamental assumption that saved passwords remain secure within the browser profile unless explicitly unlocked by the user through additional authentication mechanisms like master passwords or biometric verification. The exposure of such data can lead to unauthorized access to email accounts, banking services, and other critical online platforms where users have reused credentials across multiple sites.
Mitigation strategies for this vulnerability involve immediate updates to Google Chrome to version 153.0.8010.36 or later, which addresses the underlying logic error in the autofill subsystem that allowed data leakage. Administrators should enforce automatic update policies within their organizations to ensure all endpoints are patched promptly against known browser vulnerabilities. Additionally, users can mitigate risk by disabling autofill for sensitive fields such as passwords and credit card information through Chrome settings, opting instead to manually enter credentials or use a dedicated third-party password manager with stronger isolation controls. Enabling enhanced phishing protection features in Chrome also helps detect malicious pages attempting to harvest data via deceptive forms. Regular security audits of browser configurations and awareness training regarding the risks of visiting untrusted websites further reduce the likelihood of successful exploitation by remote attackers leveraging this specific flaw.