CVE-2026-17851 is a side-channel information leakage vulnerability in the Autofill component of Google Chrome. It affects versions prior to 151.0.7922.72 and enables a remote attacker with control over the renderer process to leak cross-origin data by crafting a malicious HTML page. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). The flaw does not impact integrity or availability, only confidentiality to a limited extent. There are no known exploits in the wild. The vendor advisory linked is a stable channel update announcement but does not explicitly confirm patch status or remediation level.

An attacker who has already compromised the renderer process in Chrome can exploit this vulnerability to leak cross-origin data through a side-channel in the Autofill feature. This results in limited confidentiality loss of user data from other origins. There is no impact on data integrity or availability. The vulnerability requires user interaction (UI:R) and network attack vector (AV:N).

The vendor advisory linked corresponds to a stable channel update for Chrome version 151.0.7922.72. Although the advisory does not explicitly state patch details, the presence of this version in the affectedVersions list and the description indicates that updating to Chrome 151.0.7922.72 or later mitigates the issue. Users should update to this version or later to remediate the vulnerability. Patch status is not explicitly confirmed in the advisory; users should verify with the official Google Chrome release notes for confirmation.