CVE-2026-106225

Analyzed Analyzed - Analysis Complete

Missing Authorization in Google Chrome Autofill

Publication date: 2026-10-06

Last updated on: 2026-10-08

Assigner: Chrome

Description

Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-08

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-106225

EUVD

EUVD-2026-93683

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 155.0.8059.39 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability involves a missing authorization check in Google Chrome's Autofill feature. An attacker could exploit this by tricking a user into visiting a specially crafted HTML page, potentially allowing them to access sensitive user information without proper permissions.

Detection Guidance

This vulnerability involves missing authorization in Google Chrome's Autofill feature. Detection primarily requires checking the Chrome version installed on systems. Use commands like 'google-chrome --version' or 'chrome://version' in the browser to verify if the version is below 155.0.8059.39.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal sensitive data such as passwords, credit card details, or personal information stored in the browser. Social engineering tactics like phishing may be used to lure victims to malicious pages.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's safeguards for protected health information. Organizations using affected Chrome versions may face compliance risks and potential penalties.

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later immediately. Disable Autofill features temporarily if an update is not immediately available. Avoid visiting untrusted websites to reduce exposure to social engineering attacks.

Hi! I’m here to help you understand CVE-2026-106225. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70