The vulnerability is an out-of-bounds read in the Payments UI code of Google Chrome. A malicious web page can trigger this bug, causing the browser to read beyond intended memory boundaries and expose the contents of sandboxed memory. The disclosed data may contain sensitive internal information, potentially weakening defensive isolation between sites. The flaw is a direct exploitation of memory safety and is classified as CWE-451.

Any user running an unpatched copy of Google Chrome older than version 156.0.8078.47 is vulnerable. The flaw is confined to the Payments UI code and does not affect other browser components, extensions, or external systems. The affected vendor is Google for its Chrome browser, and the specific affected version list is Chrome ≤156.0.8078.46.

The CVSS base score of 6.5 indicates a medium severity risk. The EPSS score, which is below 1%, suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. A remote attacker can exploit the bug by delivering a crafted web page that triggers the out-of-bounds read, leaking sandbox memory contents. No elevated privileges are required, and the attack can be carried out by any user who visits a compromised site.