CVE-2026-84327: Incorrect authorization in Google Chrome

This vulnerability in Google Chrome on Android is due to incorrect authorization in the Autofill component. A remote attacker can leverage social engineering techniques by crafting a malicious HTML page to trick users into disclosing sensitive information. The CVSS score is 6.5 (medium severity) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The affected versions are those prior to 152.0.7977.75.

An attacker can obtain sensitive information from the Autofill feature on affected versions of Chrome for Android by convincing a user to interact with a maliciously crafted webpage. This compromises confidentiality but does not affect integrity or availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should update to version 152.0.7977.75 or later once confirmed. Until then, caution with untrusted web content and social engineering attempts is advised.