Google Chrome: Incorrect authorization in Autofill on Android
Summary
Incorrect authorization checks in the Autofill feature of Google Chrome on Android allow a remote attacker to obtain sensitive information. The attacker needs the victim to open a crafted HTML page, and no login is required. The impact is confidentiality only, mainly for data stored by Autofill such as addresses, contact details and payment data.
Affected
- Google Chrome for Android prior to 155.0.8059.39
Fixed in
- Google Chrome for Android 155.0.8059.39 or later (current stable build recommended)
Workaround
- None needed when a fixed version is installed.
- For managed devices, enforce a minimum Chrome version via MDM or Google Play policies.
- Restricting Autofill is an option if business needs allow; no vendor-recommended workaround is known.
Exploitation
- No known exploitation in the wild; CISA SSVC lists exploitation as none.
- No public proof of concept known.
Our recommendation
- Verify that Chrome for Android on all company and BYOD devices is at 155.0.8059.39 or later, preferably the current stable build.
- Ensure Chrome updates through Google Play are enabled and not blocked.
- Replace or update Android devices that no longer receive Chrome updates.
- Priority: moderate. The CVSS score of 8.8 does not indicate active exploitation.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome for Android update (Google Chrome Releases) chromereleases.googleblog.com
- Chromium issue tracker 552440317 issues.chromium.org
- OSV: DEBIAN-CVE-2026-106249 osv.dev
- Ubuntu Security: CVE-2026-106249 ubuntu.com
- CISA ADP Vulnrichment summary (HOL Guard) hol.org
- OpenCVE: CVE-2026-106249 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 22:05.
Original description (NVD)
Incorrect authorization in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.