Google Chrome for Android: Information disclosure in Autofill
Summary
Incorrect reference resolution in the Autofill feature of Chrome for Android allows a remote attacker to obtain sensitive information. The attacker must lure the user to a crafted HTML page through social engineering. The CNA rates the vulnerability with CVSS 8.8, but the description only mentions information disclosure, so the real impact may be broader.
Affected
- Google Chrome for Android prior to 155.0.8059.39
- Desktop builds are not covered by the Android fix; the desktop version list in the sources conflicts and should be checked separately
Fixed in
- Chrome for Android 155.0.8059.39 or later
- Newer Chrome 155 builds also contain the fix, e.g. 155.0.8059.84 for Android (reported by third-party sources; verify against the Chrome Releases page)
Workaround
- No workaround is needed when the patch is applied.
- Chromium-based browsers on Android (e.g. Brave, Vanadium, Cromite, Edge) may ship the fix later; verify their versions directly.
Exploitation
- Exploitation in the wild: not known. CISA ADP Vulnrichment does not mark it as known exploited.
- Public proof-of-concept: none found.
- EPSS about 0.003 (low).
Our recommendation
- Inventory Android devices and browser versions, including Edge and other Chromium browsers.
- Update Chrome for Android to 155.0.8059.84 or the latest stable build via Google Play; enforce updates through MDM.
- Remind users not to open suspicious links.
- Medium-high priority for mobile fleets; no emergency action if devices already run a current Chrome 155 build.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Chrome Releases: Stable Channel Update for Desktop chromereleases.googleblog.com
- Chromium issue tracker issues.chromium.org
- MSRC update guide msrc.microsoft.com
- OSV (Debian) osv.dev
- CISA ADP Vulnrichment via HOL hol.org
- Chrome Geek: Chrome 155 stable security update www.chromegeek.com
- gHacks: Chrome 155 security fixes www.ghacks.net
- OpenCVE app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:56.
Original description (NVD)
Incorrect reference resolution in Autofill in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: High)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.