{"id":"CVE-2026-87478","title":"Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page","summary":"Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cwe":["CWE-203"],"vendor":"google","product":"chrome","affected":["chrome < 153.0.8010.36"],"patched":["chrome 153.0.8010.36"],"published":"2026-09-09","updated":"2026-09-09","sourceUpdated":"2026-09-09T17:14:57.603","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-87478","references":[{"url":"https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","label":"chrome-cve-admin@google.com"},{"url":"https://issues.chromium.org/issues/40060525","label":"chrome-cve-admin@google.com"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T14:35:51.642798Z"},"epss":0.0035,"epssPercentile":0.28541,"ingestedAt":"2026-09-09T01:17:17.511Z","slug":"CVE-2026-87478","body":"## Overview\n\nObservable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)\n\n## Affected\n\n- `chrome < 153.0.8010.36`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `chrome 153.0.8010.36`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202261,"id":"CVE-2026-87478","ts":1789400065270,"field":"cvss","old":null,"new":"6.5"},{"seq":202260,"id":"CVE-2026-87478","ts":1789400065270,"field":"severity","old":"none","new":"medium"},{"seq":200988,"id":"CVE-2026-87478","ts":1789397619032,"field":"cvss","old":"6.5","new":null},{"seq":200987,"id":"CVE-2026-87478","ts":1789397619032,"field":"severity","old":"medium","new":"none"},{"seq":199681,"id":"CVE-2026-87478","ts":1789395567283,"field":"cvss","old":null,"new":"6.5"},{"seq":199680,"id":"CVE-2026-87478","ts":1789395567283,"field":"severity","old":"none","new":"medium"},{"seq":198922,"id":"CVE-2026-87478","ts":1789392255456,"field":"cvss","old":"6.5","new":null},{"seq":198921,"id":"CVE-2026-87478","ts":1789392255456,"field":"severity","old":"medium","new":"none"},{"seq":197255,"id":"CVE-2026-87478","ts":1789384296203,"field":"cvss","old":null,"new":"6.5"},{"seq":197254,"id":"CVE-2026-87478","ts":1789384296203,"field":"severity","old":"none","new":"medium"},{"seq":196529,"id":"CVE-2026-87478","ts":1789383760084,"field":"cvss","old":"6.5","new":null},{"seq":196528,"id":"CVE-2026-87478","ts":1789383760084,"field":"severity","old":"medium","new":"none"},{"seq":195433,"id":"CVE-2026-87478","ts":1789380577043,"field":"cvss","old":null,"new":"6.5"},{"seq":195432,"id":"CVE-2026-87478","ts":1789380577043,"field":"severity","old":"none","new":"medium"},{"seq":194384,"id":"CVE-2026-87478","ts":1789378785663,"field":"cvss","old":"6.5","new":null},{"seq":194383,"id":"CVE-2026-87478","ts":1789378785663,"field":"severity","old":"medium","new":"none"},{"seq":193171,"id":"CVE-2026-87478","ts":1789376520160,"field":"cvss","old":null,"new":"6.5"},{"seq":193170,"id":"CVE-2026-87478","ts":1789376520160,"field":"severity","old":"none","new":"medium"},{"seq":191958,"id":"CVE-2026-87478","ts":1789373634198,"field":"cvss","old":"6.5","new":null},{"seq":191957,"id":"CVE-2026-87478","ts":1789373634198,"field":"severity","old":"medium","new":"none"},{"seq":190743,"id":"CVE-2026-87478","ts":1789369486963,"field":"cvss","old":null,"new":"6.5"},{"seq":190742,"id":"CVE-2026-87478","ts":1789369486963,"field":"severity","old":"none","new":"medium"},{"seq":189530,"id":"CVE-2026-87478","ts":1789368456118,"field":"cvss","old":"6.5","new":null},{"seq":189529,"id":"CVE-2026-87478","ts":1789368456118,"field":"severity","old":"medium","new":"none"},{"seq":188313,"id":"CVE-2026-87478","ts":1789365236128,"field":"cvss","old":null,"new":"6.5"},{"seq":188312,"id":"CVE-2026-87478","ts":1789365236128,"field":"severity","old":"none","new":"medium"},{"seq":187100,"id":"CVE-2026-87478","ts":1789363475690,"field":"cvss","old":"6.5","new":null},{"seq":187099,"id":"CVE-2026-87478","ts":1789363475690,"field":"severity","old":"medium","new":"none"},{"seq":185886,"id":"CVE-2026-87478","ts":1789361234751,"field":"cvss","old":null,"new":"6.5"},{"seq":185885,"id":"CVE-2026-87478","ts":1789361234751,"field":"severity","old":"none","new":"medium"},{"seq":184673,"id":"CVE-2026-87478","ts":1789358372349,"field":"cvss","old":"6.5","new":null},{"seq":184672,"id":"CVE-2026-87478","ts":1789358372349,"field":"severity","old":"medium","new":"none"},{"seq":182923,"id":"CVE-2026-87478","ts":1789354322538,"field":"cvss","old":null,"new":"6.5"},{"seq":182922,"id":"CVE-2026-87478","ts":1789354322538,"field":"severity","old":"none","new":"medium"},{"seq":181716,"id":"CVE-2026-87478","ts":1789353330387,"field":"cvss","old":"6.5","new":null},{"seq":181715,"id":"CVE-2026-87478","ts":1789353330387,"field":"severity","old":"medium","new":"none"},{"seq":180509,"id":"CVE-2026-87478","ts":1789350290078,"field":"cvss","old":null,"new":"6.5"},{"seq":180508,"id":"CVE-2026-87478","ts":1789350290078,"field":"severity","old":"none","new":"medium"},{"seq":179302,"id":"CVE-2026-87478","ts":1789348302702,"field":"cvss","old":"6.5","new":null},{"seq":179301,"id":"CVE-2026-87478","ts":1789348302702,"field":"severity","old":"medium","new":"none"},{"seq":178095,"id":"CVE-2026-87478","ts":1789346377135,"field":"cvss","old":null,"new":"6.5"},{"seq":178094,"id":"CVE-2026-87478","ts":1789346377135,"field":"severity","old":"none","new":"medium"},{"seq":176888,"id":"CVE-2026-87478","ts":1789343187070,"field":"cvss","old":"6.5","new":null},{"seq":176887,"id":"CVE-2026-87478","ts":1789343187070,"field":"severity","old":"medium","new":"none"},{"seq":175005,"id":"CVE-2026-87478","ts":1789334883691,"field":"cvss","old":null,"new":"6.5"},{"seq":175004,"id":"CVE-2026-87478","ts":1789334883691,"field":"severity","old":"none","new":"medium"},{"seq":173800,"id":"CVE-2026-87478","ts":1789333702885,"field":"cvss","old":"6.5","new":null},{"seq":173799,"id":"CVE-2026-87478","ts":1789333702885,"field":"severity","old":"medium","new":"none"},{"seq":172614,"id":"CVE-2026-87478","ts":1789331096114,"field":"cvss","old":null,"new":"6.5"},{"seq":172613,"id":"CVE-2026-87478","ts":1789331096114,"field":"severity","old":"none","new":"medium"}]}