This vulnerability is a race condition in the Payments module of Google Chrome that allows a remote attacker who has already compromised the renderer process to leak cross‑origin data through a specially crafted HTML page. The flaw permits unauthorized disclosure of sensitive information, potentially exposing credentials or personal data, and is classified as a Chromium Medium severity issue, corresponding to CWE‑367, a Time‑of‑check to Time‑of‑use error.

The flaw affects Google Chrome versions earlier than 152.0.7977.65. No other vendors or product variants are listed in the CNA data.

The CVSS score of 3.1 indicates low overall severity. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, implying limited publicly known exploitation. The attack requires the attacker to compromise the renderer process, after which a crafted page can trigger the race condition. While the risk to confidentiality is significant, the need for an initial compromise and the low exploitation probability reduce the likelihood of an attack in the near term.