Description
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Data Leak via Autofill
Action: Immediate Patch
AI Analysis

Impact

Google Chrome for Android contains a flaw in the Autofill module where internal references are not resolved correctly. An attacker can send a crafted HTML page that, when opened by a user, causes Chrome to submit stored credentials and personal data to a remote server. This vulnerability is classified as CWE-706, indicating that data from a trusted context can be extracted beyond its intended scope.

Affected Systems

Chrome for Android versions prior to 155.0.8059.39 are affected. Devices running earlier updates of Chrome on Android that have not been upgraded to at least this build remain vulnerable. The issue does not impact non‑Android platforms or later Chrome releases beyond the stated threshold.

Risk and Exploitability

The vulnerability can be exploited remotely by hosting a malicious web page, requiring only the victim’s interaction to trigger the data leak. The CVSS score of 8.8 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed widespread exploitation yet. Because exploitation relies on user‐agent interaction, environments with a high risk of phishing remain at significant risk.

Generated by OpenCVE AI on October 7, 2026 at 03:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Chrome on all Android devices to version 155.0.8059.39 or later
  • If an update is not immediately possible, temporarily disable the Autofill feature in Chrome settings to prevent the leakage of stored data
  • Conduct user awareness training to recognize and avoid visiting untrusted or suspicious web pages

Generated by OpenCVE AI on October 7, 2026 at 03:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Thu, 08 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Autofill Reference Resolution Flaw Exposes Sensitive Data via Malicious Web Page chromium-browser: Incorrect reference resolution in Autofill
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 07 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
First Time appeared Google android
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:google:android:-:*:*:*:*:*:*:*
Vendors & Products Google android

Wed, 07 Oct 2026 04:00:00 +0000

Type Values Removed Values Added
Title Autofill Reference Resolution Flaw Exposes Sensitive Data via Malicious Web Page

Tue, 06 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Weaknesses CWE-706
References

Subscriptions

Google Android Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:25:51.865Z

Reserved: 2026-10-06T16:34:51.820Z

Link: CVE-2026-106308

cve-icon Vulnrichment

Updated: 2026-10-06T20:17:12.277Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:17:59.007

Modified: 2026-10-07T13:42:42.003

Link: CVE-2026-106308

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-06T18:41:07Z

Links: CVE-2026-106308 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T03:45:10Z

Weaknesses
  • CWE-706

    Use of Incorrectly-Resolved Name or Reference