Technical impact
An inappropriate implementation in the Media Session API of Google Chrome prior to version 149.0.7827.53 allows a remote attacker to construct a crafted HTML page that bypasses the same origin policy. The flaw enables a malicious site to access or interact with resources that should be confined to a different origin, potentially exposing sensitive data or facilitating further attacks. Chromium assesses the severity of this issue as medium.
Affected Systems
Google Chrome browsers running any version earlier than 149.0.7827.53 are affected. No other vendors or products are listed.
Risk and Exploitability
The exploit requires the attacker to deliver a crafted HTML page that leverages the Media Session API; thus the attack vector is likely remote via a web page that the attacker can host or serve. Based on the description, this inference is made. The CVSS score of 6.3 indicates medium severity, while an EPSS score of <1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA KEV, meaning no confirmed public exploitation has been reported. Until a patch is applied, users of affected Chrome versions remain at moderate risk of the policy bypass.
Debian DSA