EUVD-2026-65871
GHSA-75c5-m8jv-vx92
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-reachable via crafted page with no privileges; user must visit the page (UI:R); only limited cross-origin data leakage with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
AnalysisAI
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | User must actively visit a crafted HTML page (UI:R), which the attacker controls or has injected malicious content into. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 4.3 (Medium) is consistent with the impact profile: low confidentiality loss, no integrity or availability impact, and mandatory user interaction (UI:R). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a crafted HTML page that triggers Chrome's Payments subsystem in a way that leaks data from a cross-origin context - for example, inferring the presence of payment methods or data associated with another origin visited in the same browser session. The attacker then socially engineers the target (via phishing link or malicious ad) into visiting the page. … |
| Remediation | The primary fix is to update Google Chrome to version 152.0.7977.65 or later, as confirmed by the vendor's stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today