CVE-2026-106308

Executive Summary

CVE-2026-106308 is a high-severity vulnerability in the Autofill component of Google Chrome on Android, caused by incorrect reference resolution (CWE-706). It allows a remote, unauthenticated attacker to obtain sensitive information by convincing a victim to open a crafted HTML page, requiring user interaction. The vulnerability is reported as fixed in Chrome for Android version 155.0.8059.39, but no patch confirmation, vendor advisory, public PoC, or exploit-in-the-wild evidence is available in the provided data.

Technical Analysis

The vulnerability resides in Chrome's Autofill subsystem on the Android platform. The root cause is classified as CWE-706: "Use of Incorrectly-Resolved Name or Reference." In practical terms, this class of weakness occurs when a component resolves a name, identifier, or reference to the wrong target — for example, binding an autofill suggestion to the wrong origin, frame, or field context. Because the flaw is in reference resolution rather than memory safety, exploitation does not require memory corruption and can be triggered purely through web content.

The attack surface is the browser's autofill mechanism, which processes structured page content (such as form fields and associated metadata) and maps it to stored user data like addresses, payment information, or credentials. The NVD description states the issue can be triggered via a "crafted HTML page" and requires social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the flaw is network-reachable, low complexity, requires no privileges, and needs user interaction, with high confidentiality, integrity, and availability impact.

Notably, the CVSS impact subscores indicate High for Confidentiality, Integrity, and Availability, even though the narrative description emphasizes sensitive information disclosure. This suggests the weakness may permit not only data exposure but also manipulation of autofill behavior in a way that affects data integrity and, potentially, browser stability or usability availability. However, the provided data does not include code-level details, function names, or the precise resolution logic at fault, so the exact mechanism cannot be confirmed beyond the vulnerability class.

The affected platform is specifically Chrome on Android, meaning mobile users are the primary target set. Desktop Chrome is not identified as affected in the provided data. The affected version range is "prior to 155.0.8059.39."

No public proof-of-concept, exploit code, or Nuclei template is available, and the CVE is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org, so exploit likelihood cannot be quantified from that source. Because no PoC exists publicly, any exploitation discussion must remain at the vulnerability-class level.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-706 — incorrect reference resolution) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies Android users of Chrome versions prior to 155.0.8059.39. This can be done through benign web analytics, malicious advertising, or direct delivery of links via messaging, email, or social media. Since the attack requires social engineering, the attacker's reconnaissance focuses on luring victims rather than scanning for exposed services.

2. Triggering the flaw class: The attacker hosts or injects a crafted HTML page. When the victim opens the page in a vulnerable Chrome for Android build, the page's content interacts with the Autofill subsystem in a way that causes an incorrect reference to be resolved. In CWE-706 terms, the browser binds autofill processing to the wrong reference — potentially the wrong field, frame, or origin context — which the page can influence. The attacker does not need to compromise the device or obtain credentials; the crafted page supplies the conditions.

3. Payload / execution method: At the vulnerability-class level, the "payload" is the crafted HTML content itself. Because the flaw is in reference resolution rather than code execution, there is no shellcode, no memory corruption payload, and no exploit binary. The attacker's goal is to cause the browser to resolve autofill data against an attacker-controlled context, leading to disclosure of stored autofill information. The provided data does not specify which autofill data types (e.g., addresses, payment data, credentials) are exposed, nor the exact HTML constructs required, so those details must not be assumed.

4. Post-exploitation impact: Successful exploitation yields sensitive information from the victim's autofill store, visible to the attacker's page or backend. Because the CVSS vector also rates Integrity and Availability as High, the attacker may additionally be able to alter autofill behavior or cause denial-of-service-like effects within the browser session. The stolen data can enable follow-on fraud, account takeover attempts, or targeted phishing. The attacker remains remote and does not need persistent access to the device.

Impact Assessment

CVE-2026-106308 carries a CVSS v3.1 base score of 8.8 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H breaks down as follows: Network attack vector, Low attack complexity, No privileges required, User Interaction required, Unchanged scope, and High impact to Confidentiality, Integrity, and Availability.

Business impact centers on exposure of user autofill data on Android devices running affected Chrome versions. Affected systems are mobile endpoints, not servers, so the blast radius is per-user rather than per-service. However, in enterprise environments with BYOD or managed Android fleets, a successful campaign could harvest employee personal or corporate data (addresses, payment details, and potentially saved credentials, depending on what the autofill store holds) at scale. The High Integrity and Availability subscores suggest exploitation could also disrupt or manipulate autofill behavior, though the provided data does not detail the exact integrity/availability effects.

Exploitability is constrained by the User Interaction requirement and the need for social engineering, which somewhat reduces mass-exploitation risk compared to a no-interaction flaw. There is no evidence of active exploitation, no KEV listing, and no EPSS score, so current real-world risk is assessed as potential rather than observed. Mobile users who delay Chrome updates remain exposed, and the absence of published PoC lowers but does not eliminate the chance of weaponization.

Detection Guidance

Sigma Rule

title: Potential Chrome for Android Autofill Reference Resolution Exploitation Attempt
id: 8f3c1a2e-5b7d-4c9a-9e21-7d6f0b4a2c11
status: experimental
description: Detects suspicious web content delivery patterns potentially targeting CVE-2026-106308 Autofill incorrect reference resolution in Chrome for Android
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-106308
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: proxy
  product: generic
detection:
  selection_method:
    cs-method: 'GET'
  selection_content:
    cs-uri-query|contains:
      - 'autofill'
      - 'form'
      - 'checkout'
  selection_suspicious:
    r-dns|endswith:
      - '.top'
      - '.xyz'
      - '.click'
  condition: selection_method and selection_content and selection_suspicious
falsepositives:
  - Legitimate e-commerce and form-based sites on unusual TLDs
level: low
tags:
  - attack.t1204
  - cve.2026.106308

YARA Rule

rule CVE_2026_106308_Chrome_Autofill_Reference_Resolution
{
    meta:
        description = "Detects crafted HTML pages attempting to abuse Autofill reference resolution (CVE-2026-106308)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-106308"
        severity = "high"

    strings:
        $html = "<html" nocase
        $form = "<form" nocase
        $autofill = "autofill" nocase
        $autocomplete = "autocomplete" nocase
        $input = "<input" nocase

    condition:
        $html and $form and $input and ($autofill or $autocomplete)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-106308 Potential Chrome Android Autofill Reference Resolution Exploitation"; flow:established,to_client; http.method; content:"GET"; http.header; content:"User-Agent"; content:"Android"; nocase; http.header; content:"Chrome"; nocase; file_data; content:"autofill"; nocase; file_data; content:"<form"; nocase; classtype:attempted-user; reference:cve,2026-106308; sid:2026106308; rev:1;)

Elastic Detection

process where event.type == "start" and process.name in ("chrome", "com.android.chrome") and process.command_line != null and process.command_line : "*autofill*"

Splunk SPL Query

index=proxy OR index=web
| search (uri_query="*autofill*" OR uri_query="*form*")
| where match(http_user_agent, "(?i)Android.*Chrome")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, dest_host, uri_path, http_user_agent
| where count > 3
| sort - count

Wazuh OSSEC Rule

<group name="web,cve-2026-106308,">
  <rule id="106308" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <match>autofill|form</match>
    <regex>Android.*Chrome</regex>
    <description>CVE-2026-106308: Potential Chrome for Android Autofill reference resolution exploitation attempt detected</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_106308,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Although the NVD description references version 155.0.8059.39 as the fixed release, no vendor advisory, OSV package entry, or patch source in the provided data confirms a patch. Therefore, patch status must be treated as unconfirmed.

1. Immediate mitigations:

• Enforce Chrome updates on all Android devices via managed app deployment (Google Play managed configurations or MDM), and monitor version reporting to confirm devices reach 155.0.8059.39 or later where available.
• Where immediate update is not possible, restrict high-risk browsing by disabling or limiting Autofill for addresses, payment methods, and passwords via enterprise policy where Chrome policy support allows.
• User awareness: warn users against opening unsolicited links, since social engineering is a required component of exploitation.
• Network controls: block known-malicious domains and apply proxy filtering for suspicious newly registered domains often used in lure campaigns.

2. Patch / upgrade steps:

• Update Chrome for Android to 155.0.8059.39 or later as soon as it is available through Google Play.
• Verify version after update on representative devices; confirm Autofill behavior in a test profile.
• Track the official Chrome Releases blog and Android Security Bulletins for confirmation and any revised fixed versions.

3. Long-term hardening:

• Maintain automated mobile patch compliance reporting for Chrome and Android system WebView.
• Minimize stored autofill data on managed devices; avoid saving payment and credential data in browser autofill stores.
• Integrate mobile threat defense (MTD) and secure web gateways to detect lure delivery and post-exploitation data exfiltration.
• Establish vulnerability management coverage for client-side browser flaws, not just server-side CVE tracking.

References

• NVD — CVE-2026-106308: https://nvd.nist.gov/vuln/detail/CVE-2026-106308
• CWE-706 — Use of Incorrectly-Resolved Name or Reference: https://cwe.mitre.org/data/definitions/706.html
• Google Chrome Releases (stable channel updates): https://chromereleases.googleblog.com/
• MITRE ATT&CK T1204 — User Execution: https://attack.mitre.org/techniques/T1204/
• FIRST EPSS (no score currently available for this CVE at time of writing): https://www.first.org/epss/

No threat actor campaigns or exploit-in-the-wild evidence have been identified in the provided data. CVE-2026-106308 is not listed in CISA KEV, no public PoC or exploit code is available, and no Nuclei template exists.