CVE-2026-79095: Chrome Payments Information Disclosure Flaw

CVE-2026-79095 Overview

CVE-2026-79095 is an information disclosure vulnerability in the Payments component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to obtain cross-origin data through a crafted HTML page. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Chromium assigned the issue a Medium severity rating. Exploitation requires user interaction, such as visiting a malicious web page.

Critical Impact
A remote attacker can bypass Chrome's same-origin policy in the Payments subsystem, exposing cross-origin data such as payment metadata rendered on unrelated web origins.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers embedding the vulnerable Payments component
Deployments that have not applied the Stable channel update referenced in the Google Chrome Stable Update

Discovery Timeline

2026-08-25 - CVE-2026-79095 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79095

Vulnerability Analysis

The vulnerability resides in Chrome's Payments component, which mediates the Payment Request and Payment Handler APIs. The component leaks data across origin boundaries when a crafted HTML page interacts with the payments flow. An attacker hosting a malicious page can read information belonging to an unrelated origin the victim has interacted with. The defect maps to [CWE-200] and is classified as an information leak rather than a memory-safety issue. No exploit code, proof-of-concept, or in-the-wild activity is reported in the NVD entry.

Root Cause

The root cause is improper enforcement of origin isolation within the Payments pipeline. State intended to remain scoped to the initiating origin becomes observable to a foreign origin during payment handling. This class of defect typically stems from missing origin checks on cached responses, event dispatch, or renderer-side objects shared between frames. Consult the Chromium Issue Tracker #502488051 for the upstream fix once access is granted.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must navigate to or interact with attacker-controlled content that invokes the Payments interface. No authentication or elevated privileges are required. The impact is limited to confidentiality of cross-origin data; integrity and availability are not affected. Because the flaw depends on standard browser APIs, delivery via phishing, malvertising, or compromised third-party scripts is realistic.

No verified exploitation code is available. See the Chromium Issue Tracker #502488051 for technical details when the bug is opened to the public.

Detection Methods for CVE-2026-79095

Indicators of Compromise

Browser telemetry showing outbound requests to unfamiliar domains immediately after Payment Request API invocations.
Chrome instances reporting a version string earlier than 152.0.7977.65 in endpoint inventory data.
Web page loads that instantiate PaymentRequest from newly registered or low-reputation domains.

Detection Strategies

Inventory installed browser versions across managed endpoints and flag any Chrome build below 152.0.7977.65.
Correlate proxy or DNS logs with browsing sessions that trigger payment API calls on non-commerce domains.
Alert on renderer process anomalies where cross-origin frames access payment-related event handlers.

Monitoring Recommendations

Ingest browser version telemetry into a central data lake to sustain continuous version-drift monitoring.
Track user reports of unexpected payment prompts, which can indicate crafted pages targeting this defect.
Monitor URL categorization feeds for newly observed domains referenced by payment-flow interactions.

How to Mitigate CVE-2026-79095

Immediate Actions Required

Update all Chrome installations to version 152.0.7977.65 or later using the Google Chrome Stable Update.
Force-restart Chrome after deployment so the patched binary replaces the running process.
Audit Chromium-based browsers and embedded WebViews for equivalent updates from their maintainers.

Patch Information

Google addressed the issue in the Chrome Stable channel with the release documented in the vendor advisory. Administrators should validate that endpoints report a build number at or above 152.0.7977.65. Enterprise deployments using Chrome Browser Cloud Management or Group Policy should confirm auto-update policies are active and not blocked by network controls.

Workarounds

Restrict use of the Payment Request API on untrusted sites via enterprise policy where feasible.
Route browsing through a filtering proxy that blocks newly registered or uncategorized domains until patching completes.
Advise users to avoid interacting with payment prompts on unfamiliar sites until the update is applied fleet-wide.

bash

# Verify Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# Verify Chrome version on macOS endpoints
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify Chrome version on Linux endpoints
google-chrome --version