An information leak exists in the Transactions Platform of Google Chrome before version 154.0.8037.57. The flaw allows a remote attacker to gain access to sensitive information that the user might otherwise be exposed to under normal browsing conditions. The vulnerability exploits the Transactions Platform to read data that should not be shared with web content, thereby constituting a privacy breach.

Affected by the flaw are all users running Google Chrome versions prior to 154.0.8037.57. The product is the Google Chrome browser, specifically the Transactions Platform component. No specific sub‑products or build variants are listed beyond the main Chrome stable channel.

The CVSS score of 6.5 indicates medium severity, and the issue is not listed in the CISA KEV catalog. The EPSS score is unavailable, but the documented attack requires a crafted HTML page, implying that a social engineering component is needed to entice a user to visit an adversary‑controlled web page. If a user opens such a page, a remote attacker could retrieve confidential data. Because the exploitation path depends on user interaction via a web page, the overall risk is medium but not negligible. Users and administrators should treat this as an actionable risk, especially in environments where sensitive transaction data is accessed frequently.