Technical impact
The weakness arises from insufficient validation of untrusted input (CWE‑20) and from improper authentication (CWE‑346) in the Cast implementation of Google Chrome. An attacker can supply a specially crafted HTML page that bypasses the browser’s same‑origin policy. This would allow the attacker to read or modify data from sites that the user has visited, potentially leading to data theft or injection of malicious scripts. The vulnerability is considered low severity by Chromium’s internal metrics.
Affected Systems
The flaw affects all Google Chrome installations that use a version earlier than 149.0.7827.53. Users who have not upgraded their browser are at risk. No other vendors or products are listed as affected.
Risk and Exploitability
The EPSS score is below 1% (0.00021) and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly reported exploitation at this time. The CVSS score is 4.3, reflecting low severity. Nonetheless, the bug can be triggered by loading a crafted HTML page in a victim’s browser, which requires convincing the user to visit the malicious page or opening a local file. Although the severity is low, the capability to break the same‑origin policy is valuable to threat actors for data exfiltration or script injection.
Debian DSA