Missing authorization in the Autofill feature of Google Chrome allowed a remote attacker to gather sensitive information from a user’s browser through a crafted HTML page, exposing data that should have been protected by proper access controls. The flaw is an instance of unauthorized access (CWE‑862), resulting in potential leakage of private credentials, form data, or payment details.

Google Chrome browsers on desktop platforms prior to version 155.0.8059.39 were vulnerable. The issue affected the stable channel releases published before the October 2026 update that addressed the missing authorization.

The vulnerability can be exploited by a remote attacker who social‑engineers a victim into loading a malicious page. No public exploit code is known, and the exploit requires user interaction rather than a purely automated attack. With a CVSS score of 8.8, the vulnerability is classified as high severity, and with no EPSS data available and not listed in KEV, the risk remains significant, especially for users handling sensitive personal data.