An improper handling of Payment data in Chrome for Android prior to 149.0.7827.53 allows a local attacker to read cross‑origin information through a specially crafted HTML page, resulting in a data‑exposure vulnerability that could be abused via a crafted request. The issue is associated with CWE‑352 and, according to the vulnerability list, includes CWE‑940, indicating an inappropriate use of privileged features that may further facilitate information leakage.

All users of Google Chrome on Android running versions before 149.0.7827.53 are vulnerable. The Payments component of the browser is impacted, and any local website or file capable of rendering the crafted HTML content could trigger the exploit.

The CVSS score of 6.5 indicates medium severity. The EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, implying no widely reported exploitation. However, the vulnerability requires only local device access, making it attractive for malware that operates on the same device. A successful exploitation could compromise confidential user data, and the lack of public exploits does not diminish the importance of applying the fix.