A flaw in Google Chrome’s Payments API allowed a lack of proper input validation. An attacker who had compromised the renderer process could craft an HTML page that mimics legitimate payment UI and trick users into providing sensitive information. The vulnerability enables a user to be deceived while using the browser, potentially leading to credential or payment data exposure.

The issue affects all Chrome installations using versions earlier than 151.0.7922.72. Users running these releases should verify their current patch level.

The EPSS score is below 1%, suggesting a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The CVSS score of 6.5 indicates a medium severity impact. Based on the description, the required attacker activity is to compromise the renderer process; once that is achieved, a crafted page can be served to the user and UI spoofing performed. No public exploit frameworks are currently known, but the potential for targeted attacks exists for high‑value targets.