CVE-2026-17738 describes a critical security flaw in Google Chrome's Payments feature before version 151.0.7922.72. The vulnerability arises due to insufficient validation of untrusted input, which enables a remote attacker who has already compromised the renderer process to potentially perform a sandbox escape by leveraging crafted HTML pages. This could lead to full compromise of the browser environment. The CVSS v3.1 score is 9.6, reflecting high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

Successful exploitation allows an attacker with control over the renderer process to escape the browser sandbox, potentially gaining elevated privileges and executing arbitrary code outside the sandbox restrictions. This can lead to complete compromise of the affected system's security posture through the browser.

A fix is available in Google Chrome version 151.0.7922.72 and later. Users and administrators should update to this version or newer to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.