Missing authorization in the Chromecast interface of Google Chrome versions earlier than 156.0.8078.47 allows a remote attacker to craft an HTML page that, when rendered, can execute arbitrary code outside the browser’s sandbox. This flaw represents a missing authorization (CWE‑862) that may compromise the integrity and confidentiality of the system if successfully triggered.

Google Chrome browsers older than version 156.0.8078.47 that have Chromecasting enabled are affected. The vulnerability resides in the Chromecast component, so any system running the desktop stable channel of Chrome prior to that version is at risk.

The CVSS score of 8.8 indicates high severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is listed in CISA’s KEV catalog as not listed, indicating it has not yet been widely exploited. The attack vector is remote: a malicious HTML page delivered to a user requires the renderer process to have been compromised, after which the attacker can execute code within the browser’s sandbox and potentially escape the sandbox to gain further foothold. Prompt updating to the patched version mitigates the risk.