This vulnerability arises from insufficient policy enforcement in the Payments feature of Google Chrome on Android versions before 150.0.7871.47. An attacker can exploit this by delivering a crafted HTML page that enables extraction of potentially sensitive information from the browser's process memory. The CVSS score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, and requiring user interaction. The impact is limited to confidentiality, with no integrity or availability effects reported. The vendor advisory linked does not explicitly state whether a fix has been released, and no known exploits have been observed in the wild.

An attacker can remotely obtain sensitive information from process memory in affected versions of Chrome on Android, potentially compromising user confidentiality. There is no reported impact on integrity or availability. The vulnerability requires user interaction and can be exploited over the network without privileges.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content, especially involving payments. Monitor official Google Chrome release notes for updates regarding this vulnerability.