This vulnerability in Google Chrome on Android relates to insufficient enforcement of policies within the Payments feature. An attacker can exploit this by crafting a malicious HTML page to bypass discretionary access controls, potentially leading to unauthorized actions within the Payments context. The affected versions are those prior to 148.0.7778.168. The issue was publicly disclosed on May 14, 2026, with no known exploits in the wild at the time of publication. The vendor advisory linked does not explicitly state patch availability or remediation details.

The impact is a bypass of discretionary access control in the Payments feature of Chrome on Android, which could allow unauthorized access or actions related to payment processing. The severity is considered medium by Chromium security. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content, especially involving payments. No vendor advisory states that no action is required or that the issue is already mitigated.