Description
Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Exposure
Action: Immediate Patch
AI Analysis

Impact

An incomplete cleanup in the Autofill feature on iOS versions of Google Chrome before 155.0.8059.39 permitted a remote attacker to exploit social engineering via a crafted HTML page and retrieve sensitive user data. The vulnerability is an example of excessive exposure of legacy or sensitive data (CWE‑459), and the Chromium project rated it as a high‑severity issue.

Affected Systems

Google Chrome for iOS, versions earlier than 155.0.8059.39. Users of any iOS device running affected releases are potentially impacted.

Risk and Exploitability

The attack vector is inferred to require an attacker to deliver a malicious HTML page—likely through phishing or a compromised site—which then triggers the Autofill logic to leak stored credentials or form entries. The EPSS score is not available and the vulnerability is not listed in CISA KEV, yet the CVSS score of 8.8 underscores the significant risk if exploited. No official workaround is documented, so the only practical mitigation is to update to a patched Chrome version.

Generated by OpenCVE AI on October 7, 2026 at 03:08 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome on iOS to version 155.0.8059.39 or later to apply the Autofill cleanup fix
  • Verify that Autofill data is cleared after installation by checking Chrome settings → Autofill on iOS
  • Consider disabling the Autofill feature entirely from the browser settings until a future patch is released

Generated by OpenCVE AI on October 7, 2026 at 03:08 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Chrome iOS Autofill Data Leakage via Crafted Page chromium-browser: Incomplete cleanup in Autofill
References
Metrics threat_severity

None

 threat_severity

Important

Thu, 08 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple iphone Os
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple iphone Os

Wed, 07 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Title Chrome iOS Autofill Data Leakage via Crafted Page

Tue, 06 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incomplete cleanup in Autofill in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-459
References

Subscriptions

Apple Iphone Os
Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:51.733Z

Reserved: 2026-10-06T16:31:16.403Z

Link: CVE-2026-106203

cve-icon Vulnrichment

Updated: 2026-10-06T20:17:10.369Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:46.603

Modified: 2026-10-08T12:12:55.903

Link: CVE-2026-106203

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:10Z

Links: CVE-2026-106203 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T03:15:08Z

Weaknesses