The flaw is an inappropriate implementation in the Payments handling of Google Chrome, described as a CWE‑346 Access Control weakness. A remote attacker can leak data from a different origin by serving a specially crafted HTML page. The effect is a confidentiality breach where cross‑origin information is exposed to an attacker navigating the victim’s browser.

Google Chrome versions prior to 151.0.7922.72 are affected by this vulnerability.

The CVSS score of 4.3 indicates a medium severity risk. EPSS is reported as < 1%, signifying a very low probability of exploitation in the current threat landscape, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote attacker to host a malicious HTML page that the victim visits. The attack vector is likely remote, leveraging the browser’s Payments API to read data across origins.