Zero Radar
← feed
CriticalVulnerabilityCVE-2026-76026updated 30 Oct 2026, 01:17 UTC

Google Chrome: memory flaw in Autofill can let attackers run code

A flaw in Chrome's Autofill feature (the part that fills in forms for you) can let a malicious web page run harmful code on your computer. Updating Chrome closes the hole.

Fix availableOfficial, 2 sources
SeverityCriticalCVSS 8.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesGoogle Chrome 156.0.8078.79 (Linux) and 156.0.8078.79/.80 (Windows and Mac) or later. · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker builds pageCrafted HTML page hosts the exploit
  2. 2User visits pageChrome loads the page
  3. 3Autofill memory flawMemory corruption is triggered
  4. 4Code runsArbitrary code runs inside the sandbox
  5. ResultAttacker runs code in the browser sandbox

What happened

Memory corruption in the Autofill component of Google Chrome prior to 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page.

Why it is dangerous: Anyone who visits a malicious or compromised web page while using an unpatched Chrome could have code run in the browser sandbox, which may be used as a starting point for further attacks.

Are you affected?

You are affected if you run Google Chrome on Windows, Mac or Linux with a version earlier than 156.0.8078.79 (Windows/Mac: 156.0.8078.79 or .80 is the fixed range).

Google Chrome Stable and Extended Stable channels prior to 156.0.8078.79 (Linux) and prior to 156.0.8078.79/.80 (Windows and Mac).

What to do

  1. Update Google Chrome to 156.0.8078.79 (Linux) or 156.0.8078.79/.80 (Windows and Mac) or later
  2. Restart Chrome after the update so the fix takes effect
  3. Check Chrome's version via Settings > About Chrome to confirm the update

Timeline

  1. 29 Oct 2026, 21:26 UTC
    Publicly disclosed
  2. 29 Oct 2026, 21:26 UTC
    Reported by Google Chrome · Google Chrome
  3. 29 Oct 2026, 23:07 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 01:17 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-76026
CVSS
8.8 / 10
Disclosed
29 Oct 2026, 21:26 UTC
On Zero Radar
29 Oct 2026, 23:07 UTC (2 h after disclosure)
Last change
30 Oct 2026, 01:17 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Google Chrome: memory flaw in Autofill can let attackers run code · Zero Radar