External risk intelligence

Google Chrome Autofill Use After Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-121202

The vulnerability exists within the Autofill component of a web browser (Google Chrome). Exploitation requires a user to navigate to a crafted HTML page while using the client-side application. As a client-side browser feature, it is not an internet-facing service, gateway, or management surface, and therefore does not have a public internet attack surface.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Autofill feature of Google Chrome could allow a remote attacker to execute code outside the browser's secure sandbox. This occurs if a user is tricked into visiting a specially crafted web page. While the potential for code execution exists, it requires user interaction and is confined to the user's browser session.

Bug lets attackers escape browser security.
Critical bug requires user interaction to exploit.
Focus on confirming relevance to our environment.

Attack Path

How an attacker could exploit the issue

A remote attacker can exploit a use-after-free vulnerability in Chrome's Autofill feature by tricking a user into visiting a malicious HTML page. This vulnerability, residing in the Autofill component, involves the browser attempting to use memory that has already been freed, leading to memory corruption. When successfully triggered, this can allow an attacker to execute arbitrary code outside the browser's sandbox.

Entry condition: User visits a malicious page.
Trigger point: Autofill component handles memory.
Resulting risk: Arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's Autofill feature could allow a remote attacker, through social engineering, to execute arbitrary code outside the sandbox when a user visits a specially crafted HTML page.

User-controlled web content.
Visiting a malicious HTML page.
Potential arbitrary code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Chrome's Autofill component, exploitable via a crafted HTML page, likely impacts end-user devices. The first practical step is to identify all endpoints running the affected browser version, assess their reachability and criticality, and then coordinate with IT or device management teams for remediation.

Own by End-User Device Owners.
Verify browser version on endpoints.
Plan phased user-facing updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome's Autofill feature?

Autofill is a built-in browser component designed to save time by automatically filling in web forms with stored information like addresses, phone numbers, and payment details. It processes this sensitive data locally within your browser to help you complete online forms quickly. CVE-2026-121202 affects how this component manages memory during these operations.

What does a use-after-free vulnerability mean?

This is a memory management weakness, classified as CWE-416. It happens when software continues to use a pointer to a memory location after that memory has been cleared or deleted. In this case, an attacker can manipulate this confusion to force the browser to perform unauthorized actions, potentially breaking out of its security sandbox to execute code.

How is this vulnerability triggered?

An attacker must successfully trick a user into visiting a specially crafted HTML page. Simply having the browser installed or running it in the background is not enough to trigger the bug. The memory error only occurs when the browser's Autofill component attempts to process data from a malicious site that has been designed to exploit this specific memory flaw.

Is this CVE a risk to my internet-facing servers?

No. According to Halo Surface Signal, this vulnerability is confined to the client-side browser application. Because it requires a user to navigate to a malicious page, it does not represent an internet-facing service or management gateway that is typically scanned for external exposure. The risk is primarily contained to individual end-user devices.

What is the first step to address CVE-2026-121202?

The priority is to identify which endpoints in your organization are running a version of Google Chrome older than 157.0.8103.38. Once identified, coordinate with your IT or device management teams to roll out the official browser update. Phasing these updates ensures that devices are patched against the flaw without disrupting user workflows.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.