CVE-2026-0102
Low · 3.1CVSS
3.1
EPSS
0.5%
Published
Feb 17, 2026
CISA due date
—
The record
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-73008 Exposure of private personal information to an unauthorized actor in Windows Biometric… CWE-359
- CVE-2026-21827 HCL Connections is vulnerable to an information disclosure vulnerability which could… CWE-359
- CVE-2026-74966 Information disclosure in the Form Autofill component. CWE-359
- CVE-2026-58510 GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code… CWE-359
- CVE-2026-55496 Cloudreve is a self-hosted file management and sharing system. CWE-359
- CVE-2026-58297 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
- CVE-2026-58296 Exposure of private personal information to an unauthorized actor in Microsoft Edge for… CWE-359
- CVE-2026-48615 A flaw in Node.js proxy tunnel error handling could expose proxy credentials in… CWE-359