CVE-2026-79095 in Chrome
Summary
by MITRE • 08/26/2026
Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified as an information leak within the payment processing subsystem of Google Chrome, specifically affecting versions prior to 152.0.7977.65, represents a significant breach in cross-origin isolation principles. This flaw allows a remote attacker to access sensitive data belonging to other origins through a maliciously crafted HTML page. The core technical issue stems from improper handling or exposure of payment-related state and transaction details across different security contexts. In modern web architectures, the Same-Origin Policy is designed to prevent documents loaded from one origin from accessing resources from another origin without explicit permission. However, in this instance, the browser's internal mechanisms for managing payment requests failed to strictly enforce these boundaries, resulting in a scenario where data intended for isolated processing was inadvertently made accessible to scripts running on untrusted or cross-origin pages.
From a technical perspective, this vulnerability likely involves improper separation of context within the Payment Request API implementation. When a user initiates a payment flow, sensitive information such as shipping addresses, email contacts, and potentially partial financial details are handled by the browser's secure UI components. If these internal states are exposed to the main execution thread or accessible via DOM properties without adequate sanitization or origin checks, an attacker can exploit this through standard web scripting techniques. By embedding a crafted HTML page that interacts with the payment APIs in unexpected ways, an adversary can trigger side-channel effects or direct data retrieval mechanisms that bypass intended restrictions. This type of flaw is particularly dangerous because it undermines the trust model upon which secure online transactions are built, allowing attackers to harvest personally identifiable information without user interaction beyond visiting a malicious site.
The operational impact of this vulnerability is severe for end-users and merchants alike. Successful exploitation enables cross-origin data theft, where an attacker can extract sensitive customer details such as names, addresses, and contact information from payment forms that were not intended to be shared with the attacking domain. This leads directly to privacy violations and potential identity theft scenarios. Furthermore, it compromises the integrity of e-commerce platforms by exposing user data to third-party trackers or malicious actors embedded in web pages. The severity is classified as medium within the Chromium security framework because while it does not typically allow for arbitrary code execution or full system compromise, the leakage of personally identifiable information poses a high risk to individual privacy and can facilitate further social engineering attacks.
This vulnerability aligns with CWE-200, which categorizes issues related to exposure of sensitive information to an unauthorized actor. It also maps closely to MITRE ATT&CK technique T1537, specifically the sub-technique involving data exfiltration over alternative protocols or via web services, although in this context it is more accurately described as local data access leading to cross-origin leakage. The attack vector falls under Initial Access and Collection phases where an attacker uses a crafted webpage to gather intelligence on victims. Mitigation strategies primarily involve the immediate update of Google Chrome to version 152.0.7977.65 or later, which contains patches for this specific logic error in the payment subsystem. For organizations deploying browsers at scale, enforcing automatic updates and monitoring browser versions is critical. Additionally, developers should ensure that any custom implementations interacting with web APIs adhere strictly to origin checks and avoid exposing internal state variables to global scopes where they can be accessed by cross-origin scripts.