Description
Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Published: 2026-10-06
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Patch
AI Analysis

Impact

A flaw in the Payments component of Google Chrome, present in versions before 155.0.8059.39, allows a remote attacker to leak sensitive payment data that the browser stores. The vulnerability is triggered by loading a maliciously crafted HTML page, causing the browser to disclose payment information normally protected. This issue is a confidentiality breach, corresponding to CWE-200, and permits an attacker to obtain data that should remain private.

Affected Systems

Any installation of Google Chrome older than version 155.0.8059.39 is vulnerable. The flaw exists in every supported build because the underlying payment API is universal across Chrome releases.

Risk and Exploitability

The CVSS score of 8.8 indicates high severity, but the vulnerability is not listed in the CISA KEV catalog and its EPSS score is unavailable, so the exact likelihood of exploitation is unknown. Based on the description, it is inferred that the attacker must entice a user to visit a specially crafted web page, typically through phishing or social engineering. The attack vector therefore depends on victim interaction and is limited to scenarios where a user falls for a convincing deceptive link or page.

Generated by OpenCVE AI on October 7, 2026 at 00:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Google Chrome to version 155.0.8059.39 or later
  • If a timely update cannot be performed, disable the Payments API or remove the Payments extension until a patched version is available
  • Educate users about phishing techniques and advise them to avoid visiting suspicious or unexpected web pages

Generated by OpenCVE AI on October 7, 2026 at 00:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4833-1 chromium security update
Debian DSA Debian DSA DSA-6553-1 chromium security update
History

Fri, 09 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 07 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Title chromium-browser: Information leak in Payments
References
Metrics threat_severity

None

 threat_severity

Low

Wed, 07 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Information Leak in Google Chrome Payments via Malicious HTML Page

Wed, 07 Oct 2026 00:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Tue, 06 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title Information Leak in Google Chrome Payments via Malicious HTML Page

Tue, 06 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)
Weaknesses CWE-200
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-10-06T20:15:52.357Z

Reserved: 2026-10-06T16:35:38.872Z

Link: CVE-2026-106334

cve-icon Vulnrichment

Updated: 2026-10-06T20:15:05.736Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T19:18:01.797

Modified: 2026-10-09T16:41:31.360

Link: CVE-2026-106334

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-06T18:41:42Z

Links: CVE-2026-106334 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T00:30:08Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor