Description
Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Published: 2026-08-25
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure
Action: Update
AI Analysis

Impact

An information leak exists in the Payments feature of Google Chrome versions before 152.0.7977.65. A crafted HTML page can trigger the browser to exfiltrate data that should be protected by the same‐origin policy, compromising confidentiality. This vulnerability aligns with CWE‑200, where improper isolation allows attackers to read sensitive information.

Affected Systems

Google Chrome for desktop, versions earlier than 152.0.7977.65.

Risk and Exploitability

The CVSS score for this vulnerability is 4.3, indicating low severity. The EPSS score is <1%, suggesting a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. A remote attacker can supply a malicious HTML page that, if visited by a user with an active payment session in Chrome, may enable the attacker to read cross‑origin data that should be protected by the same‑origin policy. The attack requires the victim to open a crafted web page in Chrome and depend on the Payments feature.

Generated by OpenCVE AI on August 26, 2026 at 22:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Chrome to version 152.0.7977.65 or newer, as released in the stable channel update.
  • Subscribe to Chrome release notes to stay informed about security updates for the Payments feature.
  • Consider using a separate browser or disabling the Payments feature for sensitive transactions to reduce exposure.

Generated by OpenCVE AI on August 26, 2026 at 22:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DLA Debian DLA DLA-4771-1 chromium security update
Debian DSA Debian DSA DSA-6482-1 chromium security update
History

Fri, 28 Aug 2026 15:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

Wed, 26 Aug 2026 23:00:00 +0000

Type Values Removed Values Added
Title Information Leak via Cross-Origin Payments in Chrome

Wed, 26 Aug 2026 21:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 26 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}

Wed, 26 Aug 2026 03:15:00 +0000

Type Values Removed Values Added
First Time appeared Google
Google chrome
Vendors & Products Google
Google chrome

Wed, 26 Aug 2026 01:00:00 +0000

Type Values Removed Values Added
Title Information Leak via Cross-Origin Payments in Chrome

Tue, 25 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Description Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Weaknesses CWE-200
References

Subscriptions

Google Chrome
cve-icon MITRE

Status: PUBLISHED

Assigner: Chrome

Published:

Updated: 2026-08-26T19:56:22.557Z

Reserved: 2026-08-25T06:09:20.989Z

Link: CVE-2026-79095

cve-icon Vulnrichment

Updated: 2026-08-26T19:47:43.967Z

cve-icon NVD

Status : Analyzed

Published: 2026-08-25T21:18:05.110

Modified: 2026-08-28T14:40:54.347

Link: CVE-2026-79095

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T22:45:03Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor