CVE-2026-11265: Inappropriate implementation in Autofill in Google Chrome prior to 149

Synopsis

This is a cross-origin data leak vulnerability in the Autofill feature of Google Chrome prior to version 149.0.7827.53. A remote attacker can exploit it by serving a crafted HTML page to a target user, with no authentication or interaction required, causing the browser to leak data from cross-origin contexts. Successful exploitation allows the attacker to read sensitive data that should be restricted by the browser's same-origin policy. A patched-image rebuild at version 149.0.7827.53 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the victim's browser over the network by serving a crafted HTML page from a remote host.

• AuthenticationNot required

  No account or credential is needed; the attack is executable by any remote party who can get the victim to load a page.

• Victim interactionNot required

  The CVSS vector specifies UI:N, meaning no user action beyond having the vulnerable browser load the attacker-controlled page is necessary.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• The attacker reads data from cross-origin browser contexts that the same-origin policy is supposed to isolate, such as autofill field contents populated from other origins.
• Sensitive values surfaced by the Autofill feature, including names, addresses, or other form data, become readable to the attacker.
• Confidentiality of browser-side user data is compromised; integrity and availability of the affected system are not impacted by this vulnerability.