CVE-2026-79030

Executive Summary

CVE-2026-79030 is a Medium-severity information disclosure vulnerability in Google Chrome's Autofill component, affecting all versions prior to 152.0.7977.65. A remote attacker can exploit this issue by luring a victim to a crafted HTML page, which triggers an observable discrepancy in Autofill behavior that leaks sensitive information to the attacker. Successful exploitation results in unauthorized disclosure of user data that should otherwise remain inaccessible to web content. The vulnerability is client-side in nature, requires user interaction (visiting a malicious page), and has no known public exploit or in-the-wild activity as of this report.

Technical Analysis

CVE-2026-79030 is an information disclosure vulnerability residing in Google Chrome's Autofill functionality, classified under CWE-203 (Observable Discrepancy). The flaw exists in Chromium versions prior to 152.0.7977.65 and was reported through Google's Chromium security disclosure process with a severity rating of "Medium." The vendor (Google) identified the issue internally or via their VRP (Vulnerability Rewards Program) process.

The vulnerability class — CWE-203, Observable Discrepancy — describes a condition where the application behaves differently based on the presence or absence of sensitive data, and those behavioral differences are observable to an attacker. In the context of Autofill, this typically manifests as timing differences, DOM structure changes, rendering behavior, or network-side effects that differ depending on whether autofill data (such as saved credentials, addresses, or payment information) exists for the current page or form.

The attack mechanism is browser-based and entirely client-side. The attacker crafts a malicious HTML page designed to interact with Chrome's Autofill engine. When a victim visits this page, the attacker's JavaScript can detect whether the browser has autofillable data relevant to the page's form structure. This observable discrepancy allows the attacker to infer the existence — and potentially certain characteristics — of the victim's stored autofill data without directly accessing it.

The NVD description does not provide specific technical implementation details such as the exact JavaScript API, internal function names, or the precise mechanism by which the discrepancy is exposed. Insufficient technical detail is available to describe the exact code path. However, the vulnerability class is well understood in browser security research: crafted forms, hidden fields, or timing-based side channels have historically been used to probe autofill data existence in Chromium-based browsers.

The attack surface is any user running an affected Chrome version who has Autofill enabled and visits a malicious or compromised web page. The Chrome Sandbox does not protect against this issue because the vulnerability operates at the rendering/content level, not the sandbox boundary. The attacker does NOT require any pre-existing access to the victim's system, credentials, or network position beyond the ability to deliver a web page to the victim.

Chromium severity was rated "Medium" by Google, indicating Google believes exploitation requires some user interaction and that the confidentiality impact is limited to inferring data existence rather than directly exfiltrating full autofill values. No CVSS vector was provided by NVD at the time of writing.

Exploitation Scenarios

No public PoC is available for this vulnerability; the attack chain described below is inferred from the vulnerability class (CWE-203) and the NVD description.

Step 1 — Reconnaissance / Target Identification The attacker identifies targets who are likely to have valuable Autofill data stored in Chrome. This can include individuals who use Chrome for online banking, e-commerce, or accessing corporate portals where saved addresses, payment methods, or login forms are autofilled. The attacker does not need to enumerate specific Chrome versions per-target; instead, the crafted page simply fails to exploit patched browsers while working against vulnerable ones.

Step 2 — Triggering the Flaw The attacker crafts a malicious HTML page containing form structures designed to interact with Chrome's Autofill engine. The page may include hidden form fields, invisible iframes, or other DOM constructs that cause the Autofill engine to render or behave differently depending on whether saved autofill data matches the form. The attacker's JavaScript monitors for observable divergences — such as painted frame timing, mutation observer callbacks, focus events, or computation timing — that leak the existence of autofill data.

Step 3 — Payload / Execution Method (Vulnerability-Class Level) The "payload" in this case is purely passive — the attacker's page does not execute arbitrary code. Instead, the page measures the observable discrepancy: when Autofill data exists, Chrome may render the page differently, fire JavaScript events at different times, or expose subtle DOM mutations that do not occur when no data is present. These differences are collected by the attacker's scripts and encoded to infer the presence and possibly field-specific details of the victim's stored data.

Step 4 — Post-Exploitation Impact Once the attacker identifies that a victim has autofill data (and potentially which fields), this data point itself becomes intelligence for further attacks. The attacker may combine this knowledge with social engineering, phishing, or follow-on attacks. For example, knowing the victim has saved payment information on a specific domain could inform a targeted credential-harvesting campaign. In a corporate context, knowing a victim autofills credentials on a particular portal could aid in targeted phishing or account-takeover attempts.

Impact Assessment

Business Impact: The primary impact is confidentiality loss. Sensitive user data — such as saved addresses, credit card numbers, or login credentials — may have its existence revealed to malicious web content. While the NVD description does not confirm full data exfiltration, the observable discrepancy may allow attackers to infer the presence and type of stored Autofill data, which itself is sensitive. For enterprises, this affects any employee using Chrome with Autofill enabled, including those accessing corporate systems.

Affected Systems: Google Chrome desktop and mobile versions prior to 152.0.7977.65. This includes Windows, macOS, Linux, and Android platforms, as well as Chromium-based applications that embed the vulnerable Chromium version.

Blast Radius: Medium. The attack requires a victim to visit a malicious page, which limits large-scale automation. However, every Chrome user with default settings who encounters a malicious page is at risk. The Chromium security severity of "Medium" reflects that this is not a sandbox escape or RCE, but a privacy leak with a UI-based exploitation requirement.

CVSS Reference: The provided CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects: network attack vector with low attack complexity, no privileges required, but user interaction required. Scope is unchanged, and the impact is high confidentiality (for the leaked information) with no integrity or availability impact.

Known Campaigns: No known threat actor campaigns or exploit-in-the-wild evidence existed as of the CISA KEV assessment, which lists this CVE as NOT applicable.

Detection Guidance

Sigma Rule

title: Chrome Autofill Information Disclosure Attempt via Crafted HTML
id: 371b8c3e-7a48-4d19-9d5c-9c5f3e7b2a1c
status: experimental
description: Detects browsers loading HTML pages attempting to probe Autofill data via observable discrepancy techniques, potentially indicating CVE-2026-79030 attempts.
tags:
    - attack.t1189
    - attack.initial-access
    - cve.2026-79030
logsource:
    category: proxy
    product: http
detection:
    selection:
        http.url|contains:
            - 'autocomplete'
            - 'autofill'
        http.user_agent|contains:
            - 'Chrome/1'
            - 'Chrome/2'
            - 'Chrome/3'
            - 'Chrome/4'
            - 'Chrome/5'
            - 'Chrome/6'
            - 'Chrome/7'
            - 'Chrome/8'
            - 'Chrome/9'
            - 'Chrome/10'
            - 'Chrome/11'
            - 'Chrome/12'
            - 'Chrome/13'
            - 'Chrome/14'
            - 'Chrome/15'
    filter:
        http.url|contains:
            - 'google.com'
            - 'chromium.org'
    condition: selection and not filter
level: medium
falsepositives:
    - Legitimate websites using autocomplete/autofill features
    - Development environments testing autofill functionality

Note: This rule is a heuristic approach; precise detection of this client-side vulnerability via network logs is inherently limited.

YARA Rule

rule CVE_2026_79030_Chrome_Autofill_Probe {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects HTML content attempting to probe Chrome Autofill behavior"
        date = "2026-02-10"
        cve = "CVE-2026-79030"
        severity = "Medium"
    strings:
        $s1 = "autocomplete" nocase
        $s2 = "autofill" nocase
        $s3 = "addEventListener" nocase
        $s4 = "MutationObserver" nocase
        $s5 = "performance.now" nocase
        $s6 = "addEventListener('focus'" nocase
        $s7 = "getBoundingClientRect" nocase
        $s8 = "iframe" nocase
        $s9 = "contentWindow" nocase
    condition:
        (2 of ($s1, $s2)) and (1 of ($s3, $s4, $s5, $s6, $s7)) and ($s8 or $s9)
}

Note: This rule targets generic HTML-based autofill-probing patterns and may generate false positives on benign autofill-heavy pages.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-79030 - Chrome Autofill Probe via Crafted HTML"; flow:established,to_server; http.request_body; content:"autofill"; nocase; http.request_body; content:"addEventListener"; nocase; http.request_body; content:"MutationObserver"; nocase; metadata:cve CVE-2026-79030; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-79030; classtype:attempted-information-leak; sid:79030001; rev:1;)

Note: This rule will not fire on HTTPS traffic without SSL inspection and may require additional Logstash/Pcap characteristics for efficacy.

Elastic Detection

// Elastic EQL query for proxy/web gateway access logs
sequence by source.ip with maxspan=30s
  [network where dns.question.name != "" and event.action == "lookup" and 
   not dns.question.name : "*.google.com" and not dns.question.name : "*.chromium.org"]
  [http where event.category == "web" and 
   http.response.status_code == 200 and
   url.path : "*autofill*" or user_agent.original : "Chrome/*"]

Note: This EQL detects browsers accessing paths associated with autofill probing; limited by HTTPS visibility.

Splunk SPL Query

index=proxy OR index=web
| where like(user_agent, "Chrome/%") 
| where match(url, "(?i)autofill") OR match(url, "(?i)autocomplete")
| where NOT match(url, "(?i)google\.com") 
| stats count by src_ip, dest_ip, url, user_agent
| sort - count
| rename src_ip as "Source IP", dest_ip as "Destination IP", url as "URL", user_agent as "User Agent", count as "Request Count"

Wazuh OSSEC Rule

<group name="chrome_autofill_probe,">
  <rule id="790300" level="8">
    <decoded_as>json</decoded_as>
    <field name="user_agent">\.*Chrome/.*\.</field>
    <field name="url">\.*autofill.*\.</field>
    <description>CVE-2026-79030 suspicious Chrome autofill probe attempt</description>
    <group>cve_2026_79030,</group>
    <mitre>
      <id>T1189</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The only patch source is NVD, which lists the vulnerable version and the fixed version 152.0.7977.65. Google has not yet published an independent advisory that this analysis could confirm.

Immediate Mitigations:

1. Upgrade Chrome: Update all Google Chrome installations to version 152.0.7977.65 or later. This is the only directly confirmed patch. Use Group Policy or enterprise management tooling to enforce the update across all endpoints.
2. Disable Autofill: As a temporary measure, disable Autofill in Chrome settings (chrome://settings/autofill) until the patch is verified. This eliminates the vulnerable attack surface entirely, though it affects usability.
3. Restrict Unknown Page Access: Enable URL filtering and web gateway policies to block unknown or unsuspected domains, reducing exposure to crafted pages.

Patch / Upgrade Steps:

• For managed endpoints: Push the update via Chrome Enterprise policies (e.g., ChromeUpdate policy) or third-party patch management.
• Verify deployed version using chrome://version on endpoints or via enterprise reporting.
• Monitor browser version telemetry to ensure no systems remain below 152.0.7977.65.

Long-Term Hardening:

• Enforce automatic browser updates for Chrome in enterprise environments.
• Implement browser isolation for untrusted web content where feasible.
• Educate users on the risk of visiting unknown links, especially on personal devices used for work.
• Monitor Google Chrome Releases Blog (https://chromereleases.googleblog.com) for official advisory confirmation and any supplementary guidance.
• After patch, re-enable Autofill and conduct a quick verification of Autofill behavior on a test page to confirm the observable discrepancy is resolved.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-79030 — Official NVD database entry with the vulnerability description and affected version range.
2. Google Chrome Releases Blog: https://chromereleases.googleblog.com — Patch release notes for Chrome 152.0.7977.65 (advisory pending confirmation at time of writing).
3. MITRE ATT&CK T1189: https://attack.mitre.org/techniques/T1189/ — Drive-by Compromise technique used to classify this attack vector.
4. CWE-203 Description: https://cwe.mitre.org/data/definitions/203.html — Common Weakness Enumeration entry describing the Observable Discrepancy vulnerability class.
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Confirmed as NOT known to be exploited in the wild (no KEV entry).

Threat Actor Campaigns: None identified. No exploit-in-the-wild evidence or public PoC was available as of this report's writing.