The vulnerability arises from an inappropriate implementation in the Media Session API in Chrome before version 149.0.7827.53, which allows a remote attacker to construct a crafted HTML page that bypasses the same origin policy. This flaw lets a malicious site access or interact with resources that should be restricted to a different origin, potentially exposing data or enabling further attacks. The Chromium team rates the severity as medium.

Google Chrome browsers running versions earlier than 149.0.7827.53 are affected. No other vendors or products are listed.

The flaw can be exploited from any web page that the attacker can host or serve, making the attack vector remote via the browser. No CVSS score is provided, and EPSS is unavailable; the vulnerability is not listed in CISA KEV, indicating no confirmed public exploitation. Given the severity rating and the wide use of Chrome, the risk remains moderate to high until the patch is applied.