A remote attacker can craft a malicious HTML page that, when viewed in Chrome, manipulates the Payments UI to display falsified purchase information, potentially leading users to approve undesired transactions. The flaw stems from insufficient validation of untrusted input within the Payments component, corresponding to input‑validation weaknesses. This UI‑spoofing could deceive users into providing payment details or confirming fraudulent purchases, thereby violating the confidentiality and integrity of the user’s financial data.

Google Chrome browsers built before version 151.0.7922.72 are affected. The vulnerability exists across all desktop Chrome installations that have not applied the latest update containing the payment input validation fix.

The CVSS score of 4.3 classifies the vulnerability as low severity, and the EPSS score indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, and no widespread exploitation has been reported. Exploitation requires a victim to view a crafted HTML page, so the attack vector is remote but user‑interaction dependent. Because the flaw lies in input validation, an attacker cannot bypass authentication; they can only trick the user into approving a transaction through UI deception.