Google Chrome EUVD-2026-65871

User must actively visit a crafted HTML page (UI:R), which the attacker controls or has injected malicious content into. Chrome's Payments subsystem must be reachable from the page context - this is true for standard Chrome desktop installations without special enterprise policy disabling the Payment Request API. No authentication, prior access, or special user privilege is required from the attacker's perspective (PR:N). Exploitation is limited to reading cross-origin data only (C:L); there is no write or denial-of-service capability. The unchanged scope (S:U) means the attacker cannot pivot to the underlying OS or other browser origins beyond the specific leak. Chromium issue #502488051 is not publicly disclosed at the detail level needed to reconstruct the primitive without access to the restricted tracker entry.

The CVSS base score of 4.3 (Medium) is consistent with the impact profile: low confidentiality loss, no integrity or availability impact, and mandatory user interaction (UI:R). The EPSS score of 0.22% at the 13th percentile reinforces that this vulnerability is unlikely to see widespread opportunistic exploitation - it is not in CISA KEV, and no POC has been identified. The combination of UI:R and S:U means exploitation requires social engineering to lure a target to a crafted page and does not enable privilege escalation or sandbox escape. Real-world risk is therefore moderate-to-low: the vulnerability is real but yields only limited cross-origin data, and exploitation requires deliberate targeting of a specific user. For high-value targets (e.g., users whose payment-related browser state could be of intelligence value), the risk profile warrants prompt patching. For general populations, the low EPSS and absence of KEV/POC supports standard patch cadence rather than emergency response.

An attacker hosts a crafted HTML page that triggers Chrome's Payments subsystem in a way that leaks data from a cross-origin context - for example, inferring the presence of payment methods or data associated with another origin visited in the same browser session. The attacker then socially engineers the target (via phishing link or malicious ad) into visiting the page. No public exploit code has been identified at time of analysis, so exploitation currently requires independent rediscovery of the technique from the Chromium issue tracker.