EUVD-2026-50625
GHSA-6frp-279q-xv29
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker crafts malicious HTML page
-
DeliveryVictim navigates to attacker-controlled URL
-
ExploitChrome Payments component processes cross-origin request
-
ExecutionOrigin validation check bypassed (CWE-346)
-
PersistCross-origin payment data returned to attacker page
-
ImpactAttacker exfiltrates leaked data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | The victim must be running Google Chrome prior to version 151.0.7922.72 on a supported desktop platform and must actively visit an attacker-controlled HTML page (UI:R - passive browsing or drive-by without click is insufficient given the crafted-page requirement). The vulnerability is specific to the Payments component; exploitation is most impactful when the victim has an active or recently active payment-related session in another origin tab, as that cross-origin data is the target of the leak. The CVSS PR:N metric confirms no authentication to the attacker's infrastructure is required. Limiting factors: mandatory user interaction (clicking a link or navigating to the malicious page), Chrome-specific scope (no evidence of impact on other Chromium derivatives from available data), and the constrained Payments-component attack surface rather than a general cross-origin read primitive. |
| Impact | The CVSS 3.1 base score of 4.3 (Medium) accurately reflects a moderate real-world risk profile. The attack vector is network (AV:N) with low complexity (AC:L) and no required privileges (PR:N), but mandatory user interaction (UI:R) - the victim must visit an attacker-controlled HTML page - is the key friction point. The unchanged scope (S:U) and limited confidentiality impact (C:L) confirm the blast radius is constrained to data accessible through the Payments component channel rather than full cross-origin read. EPSS at 0.18% (8th percentile) is consistent with these limiting factors and indicates the vulnerability is unlikely to be exploited at scale. There is no CISA KEV listing and no known public exploit, further corroborating low operational risk. For most organizations, this is a patch-on-next-cycle issue. High-value financial or e-commerce environments where users conduct payment flows in Chrome should treat it with moderate urgency, as the Payments-specific attack surface aligns with their threat model. |
| Exploit ScenarioDerived | An attacker registers or compromises a website and embeds a crafted HTML page that invokes Chrome's Payments component in a manner that triggers the origin validation error, causing the browser to return or expose data belonging to a different origin. The attacker then distributes the link via phishing email or malicious advertisement, waits for a Chrome user to visit the page, and harvests the leaked cross-origin data - potentially including payment-session identifiers or other data surfaced through the Payments API from a co-loaded origin. No public proof-of-concept code has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.
RemediationAI
Vendor-released patch: Chrome 151.0.7922.72. Update all Chrome installations to version 151.0.7922.72 or later per the stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. Chrome auto-updates by default; enterprise administrators should verify propagation via Chrome Browser Cloud Management or Group Policy and confirm the installed version reaches 151.0.7922.72. As a compensating control where immediate patching is constrained, restricting browser access to untrusted external pages via web proxy or DNS filtering reduces exposure but carries significant usability trade-offs. Organizations that do not use web-based payment flows could evaluate disabling the Payment Request API through Chrome enterprise policy, though this will break legitimate payment UI on affected sites. Neither workaround substitutes for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Google Chrome's Payments component - most likely the Payment Request API or adjacent payment-handling logic - across all versions prior to 151.0.7922.72 (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). CWE-346 (Origin Validation Error) identifies the root cause class: the Payments subsystem fails to properly enforce origin boundaries when processing or responding to payment-related requests, allowing data belonging to one origin to be read by a script executing under a different origin. The same-origin policy (SOP) is the browser's foundational isolation mechanism; an 'inappropriate implementation' in a feature-specific subsystem like Payments can introduce a localized bypass even when the broader SOP enforcement is intact. The Chromium bug tracker reference (issues.chromium.org/issues/522425471) is the upstream tracking issue, reported by the Chrome team itself.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via crafted page requiring victim navigation (UI:R); no attacker authentication; impact limited to partial cross-origin confidentiality leak with no integrity or availability effect.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-346 – Origin Validation Error
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB