A remote attacker can trigger side‑channel leakage of private form data in Google Chrome by delivering a crafted webpage that forces the user to perform specific UI gestures while the Autofill feature is active. The flaw does not involve code execution or traditional input validation; instead, it exploits subtle timing differences that expose data stored for other origins such as addresses, credit card numbers, or passwords, compromising user privacy.

Google Chrome desktop browsers before version 151.0.7922.72 on all supported operating systems are affected. The issue is referenced in the July 2026 stable channel update and applies universally across Windows, macOS, and Linux distributions using that Chrome release

The CVSS base score of 4.3 classifies the vulnerability as medium, largely because it requires the victim to visit a malicious site and perform intentional gestures. The EPSS score is below 1 %, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, once triggered, the side‑channel leak can reveal confidential information across origins without granting the attacker direct code execution or elevated privileges.