The vulnerability is an input validation flaw in the Chrome Cast feature. An attacker on the same local network segment can serve a specially crafted HTML page that exploits the insufficient validation of untrusted input, allowing the browser to execute code with elevated privileges on the victim’s computer. The weakness is a classic Improper Input Validation (CWE‑20) that removes the boundary between trusted and untrusted data, enabling privilege escalation via a browser session.

Affected products are Google Chrome browsers running any version earlier than 149.0.7827.53 on desktop platforms. The fix was released with the 149.0.7827.53 update to the stable channel. All users of older Chrome versions should upgrade immediately.

The CVSS score of 8 categorizes this flaw as high severity, and although Chromium labels it as low severity, it still allows a local network attacker to gain elevated privileges without user interaction after delivering a crafted page. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers who can reach the victim’s machine on the local network can exploit this flaw, so the risk is localized but serious for any exposed network environment.