This vulnerability in Google Chrome (CVE-2026-17742) arises from insufficient policy enforcement in the Payments component before version 151.0.7922.72. An attacker can craft a malicious HTML page that causes cross-origin data leakage, violating the same-origin policy. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and limited confidentiality impact. There are no known exploits in the wild. The vulnerability is tracked under CWE-346 (Insufficient Authorization).

An attacker can remotely cause leakage of cross-origin data via a crafted HTML page, potentially exposing sensitive information accessible through the Payments feature. The impact is limited to confidentiality loss; integrity and availability are not affected. Exploitation requires user interaction.

A fixed version of Google Chrome is available at 151.0.7922.72. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory confirms the fix is included in this release. No additional mitigations are specified or required.