Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak… (CVE-2026-78894)

CVE-2026-78894 is a race condition vulnerability in the Payments feature of Google Chrome versions before 152.0.7977.65. This flaw enables a remote attacker, with control over the renderer process, to leak data across origins by using a specially crafted HTML page. The vulnerability is classified under CWE-367 (Time-of-check Time-of-use Race Condition) and has a CVSS 3.1 base score of 3.1, indicating low impact. No official patch information or vendor advisory is provided in the data.

The impact is limited to confidentiality as the attacker can leak cross-origin data. There is no impact on integrity or availability. The attacker must have already compromised the renderer process, which limits the scope of exploitation. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for updates from Google Chrome regarding this vulnerability. No additional mitigation steps are specified.