This vulnerability involves an inappropriate implementation in the Payments feature of Google Chrome before version 151.0.7922.72. It enables a remote attacker to leak cross-origin data by tricking a user into visiting a specially crafted HTML page. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and confidentiality impact only. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm patch availability or remediation level.

An attacker can leak cross-origin data from the browser via a crafted HTML page, potentially exposing sensitive information. There is no impact on data integrity or availability. Exploitation requires user interaction, such as visiting a malicious webpage.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version when available and exercise caution with untrusted web content.