Listen to this Post
CVE-2026-17730 is a medium‑severity side‑channel information leakage vulnerability in Google Chrome’s Autofill component, affecting all versions prior to 151.0.7922.72. The flaw allows a remote attacker, by convincing a user to perform specific UI gestures on a maliciously crafted HTML page, to leak cross‑origin data. This is not a traditional memory corruption bug but a subtle timing‑based side‑channel that exploits how Chrome’s autofill system responds to user interactions.
At its core, the vulnerability stems from insufficient isolation between cross‑origin contexts within the autofill subsystem. When a user interacts with form fields on a webpage, Chrome’s autofill engine evaluates whether saved data (e.g., addresses, credit card numbers, or login credentials) matches the input field. The underlying mechanism uses a series of internal checks that produce slightly different execution times or observable state changes depending on whether a match exists. An attacker can measure these micro‑timing variations or monitor CSS pseudo‑classes like `:autofill` to infer the presence of specific saved entries.
The attack chain begins with the victim visiting a page controlled by the attacker. The page contains hidden or invisible form fields that are programmatically focused and blurred in rapid succession. By carefully orchestrating these UI gestures—such as clicking, tabbing, or hovering—the attacker forces Chrome to repeatedly invoke the autofill suggestion logic. Each invocation triggers a lookup in the user’s saved autofill data, and the response time or visual feedback (e.g., the appearance of a dropdown) reveals a binary signal: “data exists” or “data does not exist.”
Over thousands of iterations, the attacker can brute‑force the contents of saved autofill entries. For example, by cycling through possible prefixes of an email address or a credit card number and measuring the response time for each, the attacker reconstructs the complete value character by character. This is possible because the autofill system performs a prefix‑based matching algorithm; the time taken to return a match increases with the length of the prefix, creating a measurable side‑channel. The attack is entirely client‑side and does not require any network interception or privilege escalation.
The vulnerability is particularly dangerous because it bypasses the Same‑Origin Policy. Although the attacker’s page runs in one origin, the autofill data originates from the user’s stored profile, which may contain information from multiple origins (e.g., saved addresses used on shopping sites). By leaking this data cross‑origin, the attacker can harvest sensitive personal information without the user’s knowledge. The attack requires only that the user be convinced to perform simple gestures like clicking or pressing a key—actions that are commonplace and unlikely to raise suspicion.
Google addressed the issue by introducing a frame‑scoped token bucket rate limiter on `AskForValuesToFill()` calls inside the AutofillAgent. This throttles rapid, automated probing while leaving legitimate interactive bursts unaffected. The fix was included in Chrome 151.0.7922.72, released on July 29, 2026. Users and administrators are strongly advised to update immediately, as the vulnerability has been classified as medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Although the impact is limited to confidentiality, the ease of exploitation and the sensitivity of the leaked data make this a critical privacy concern.
DailyCVE Form:
Platform: Google Chrome
Version: < 151.0.7922.72
Vulnerability: Side‑channel info leakage
Severity: Medium (CVSS 4.3)
date: 07/29/2026
Prediction: 07/29/2026
Analytics under heading What Undercode Say:
Check current Chrome version (Linux)
google-chrome --version
Check current Chrome version (Windows PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Verify if the patch is applied by searching for the fix commit
git log --oneline --grep="Throttle brute-force probing of autofill data"
Monitor autofill events for suspicious rapid calls (Chromium tracing)
chrome --trace-startup --trace-categories="autofill"
Simulate a probing attack using a simple HTML/JS snippet (educational only)
for (let i = 0; i < 1000; i++) {
let input = document.createElement('input');
input.setAttribute('autofill', 'on');
input.focus();
input.blur();
}
How Exploit:
- Craft a malicious HTML page with invisible form inputs and a script that cycles through potential autofill values (e.g., common name prefixes, credit card BINs).
- Lure the victim to the page and trick them into performing repeated UI gestures (e.g., holding down a key, clicking rapidly, or moving the mouse over hidden elements).
- Measure timing differences in the autofill suggestion popup or observe changes in the `:autofill` CSS pseudo‑class using `getComputedStyle()` or
MutationObserver. - Brute‑force the data by correlating the measured times with the input prefixes; shorter response times indicate a match, allowing reconstruction of the full saved entry.
- Exfiltrate the leaked cross‑origin data (e.g., addresses, phone numbers, or credit card details) by sending the results to an attacker‑controlled server via `fetch()` or
XMLHttpRequest.
Protection from this CVE:
- Immediate action: Update Google Chrome to version 151.0.7922.72 or later. The patch introduces rate‑limiting on autofill probing requests, effectively neutralizing the brute‑force side‑channel.
- Enterprise mitigation: Use group policies to enforce automatic updates and restrict access to untrusted websites. Consider enabling Chrome’s “Enhanced Protection” mode for additional safeguards.
- User awareness: Educate users about the risks of interacting with untrusted web pages and the importance of keeping the browser up‑to‑date.
- Developer guidance: Web developers should avoid relying on autofill for sensitive data in cross‑origin contexts and consider using `autocomplete=”off”` where appropriate, though this does not directly prevent the side‑channel.
- Long‑term strategy: Browser vendors should implement uniform timing‑attack mitigations across all input‑handling components and conduct regular side‑channel security reviews.
Impact:
- Confidentiality breach: An attacker can extract saved autofill entries, including full names, postal addresses, email addresses, phone numbers, and credit card details, from the victim’s browser profile.
- Cross‑origin data leakage: The attack bypasses the Same‑Origin Policy, allowing a malicious site to read data that belongs to other origins (e.g., shopping or banking sites).
- Privacy violation: Users’ personal information can be harvested without any visible signs of compromise, enabling targeted phishing, identity theft, or financial fraud.
- Enterprise risk: In corporate environments, exposed autofill data may include internal addresses, VPN credentials, or other sensitive business information, potentially leading to further network intrusions.
- Reputation damage: Organizations whose employees fall victim to this attack may suffer reputational harm and regulatory penalties under data protection laws (e.g., GDPR, CCPA).
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
