Insufficient enforcement of payment‑related policies in Google Chrome versions earlier than 151.0.7922.72 enables a remote attacker to execute a crafted HTML page that leaks data originating from other domains. The result is outbound exposure of sensitive payment information that is normally protected by same‑origin restrictions. This flaw allows disclosure of confidential data but does not permit code execution or direct system compromise.

Google Chrome browsers running any version older than 151.0.7922.72 are impacted. The vulnerability was disclosed for all Chrome desktop channels (stable, beta…).

The CVSS score is 4.3, reflecting medium severity and limited impact. The EPSS score of less than 1% indicates a very low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is a malicious web page that a victim visits, which then triggers the payment interaction and leaks cross‑origin data. Because the flaw is client‑side and requires user action to load the crafted page, the overall threat is moderate but the potential damage depends on the sensitivity of the leaked data.