The vulnerability is a memory corruption flaw in the Payments component of Google Chrome. A remote attacker can exploit this flaw by delivering a specially crafted HTML page that triggers the vulnerable code, allowing execution of arbitrary code within the browser sandbox.

The flaw affects Google Chrome versions prior to 156.0.8078.73. Any installation of Chrome with an older version that still includes the vulnerable Payments code is susceptible.

The flaw is rated high in Chromium severity and provides a remote code execution path. Exploitation requires the victim to view a crafted HTML page, typically via a malicious website. While the EPSS score is currently unavailable and the issue has not been listed in CISA's KEV catalog, the high severity and the possibility of injection into sandboxed processes signal a significant risk. No public exploit has been documented, but the absence of EPSS data suggests that the probability of exploitation is uncertain and potentially low; however, the impact of successful exploitation would be full system compromise.