Insufficient policy enforcement in the Payments component of Google Chrome for Android before version 148.0.7778.168 allows a remote attacker to bypass discretionary access controls by delivering a crafted HTML page. This flaw permits an attacker to circumvent the browser’s intended authorization checks for payment operations, effectively granting unauthorized control over payment interactions within the user’s browsing session.

All installations of Google Chrome for Android with a stable channel version earlier than 148.0.7778.168 are affected. The vulnerability is tied to the Payments feature in the browser and was addressed in the May 2026 stable channel update.

The CVSS score of 4.3 marks this vulnerability as medium severity, while an EPSS score of less than 1% indicates a very low likelihood of exploitation, suggesting no widespread exploitation is currently observed. The vulnerability is not listed in the CISA KEV catalog. The attack vector is a remote in-browser attack: an attacker must host a malicious web page containing a crafted payload and convince an affected user to load it while using Chrome on Android.