This flaw is a Missing Authorization vulnerability (CWE-346, CWE-862) that allows a remote attacker who has gained control of the renderer process to bypass the web origin policy by loading a specially crafted HTML page. This can enable the attacker to read or leak information from web pages that the user visits, effectively compromising data confidentiality and potentially allowing further malicious actions such as phishing or credential theft.

All users of Google Chrome running versions earlier than 154.0.8037.92 are susceptible, regardless of platform, as the issue resides in the core payments component shared across Chrome builds.

The CVSS score of 6.5 indicates moderate to high risk. The vulnerability requires the attacker to already compromise the renderer process, which is a non‑trivial prerequisite; no publicly available exploitation proof has been reported. The EPSS score is < 1%, indicating a very low exploitation probability, and the flaw is not listed in the CISA KEV catalog. Consequently, while the potential impact is significant for an attacker who can exploit the renderer, the likelihood of exploitation in the wild remains limited at present.