CVE-2026-84327: Incorrect authorization in Autofill
Chromium: CVE-2026-84327 Incorrect authorization in Autofill
Other sources
Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.7977.75 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 152.0.4191.62 - Upgrade
Upgrade
Chromium (Android)to a version that resolves this vulnerability.Fixed in 152.0.7977.75
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2026-84353
- CVE-2026-84352
- CVE-2026-84354
- CVE-2026-84359
- CVE-2026-84357
- CVE-2026-84324
- CVE-2026-84349
- CVE-2026-84326
- CVE-2026-84333
- CVE-2026-84351
- CVE-2026-84325
- CVE-2026-84328
- CVE-2026-84347
- CVE-2026-84323
- CVE-2026-84355
- CVE-2026-84358
- CVE-2026-84332
- CVE-2026-84330
- CVE-2026-84334
- CVE-2026-84348
- CVE-2026-84335
- CVE-2026-84329
- CVE-2026-84356
- CVE-2026-84350
- CVE-2026-84331
Frequently Asked Questions
Which Chrome installations are affected?
Google Chrome on Android versions prior to 152.0.7977.75 are affected. The provided information does not identify affected desktop versions.
What must an attacker do to exploit this issue?
The attacker needs to use a crafted HTML page and rely on social engineering. Successful exploitation can allow the attacker to obtain sensitive information through Chrome Autofill.
How should organizations mitigate the issue?
Update Chrome on Android to version 152.0.7977.75 or later. The provided information does not specify an alternative workaround if updating is not immediately possible.