Race condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web… (CVE-2026-79014)

CVE-2026-79014 is a race condition vulnerability in the Autofill component of Google Chrome before version 152.0.7977.65. It enables a remote attacker, with control over the renderer process, to bypass the web origin policy by exploiting a timing issue in the Autofill implementation triggered by a crafted HTML page. This could potentially lead to unauthorized access to autofill data across origins. The vulnerability is rated with a CVSS 3.1 score of 4.3 (medium severity) and is categorized under CWE-362.

The vulnerability allows bypassing of the web origin policy, which is a fundamental security control in browsers to isolate content from different origins. This could lead to unauthorized access to autofill data within the compromised renderer process context. However, exploitation requires prior compromise of the renderer process, limiting the attack scope. The impact is limited to confidentiality (partial data disclosure) with no integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply general security best practices such as avoiding untrusted content and ensuring renderer process isolation. Monitor official Google Chrome security advisories for updates and apply the update to version 152.0.7977.65 or later once available.