Missing authorization in the Chromecast component of Google Chrome versions prior to 156.0.8078.47 lets a remote attacker who has already compromised the renderer process obtain sensitive information via a crafted HTML page. The flaw stems from insufficient authentication checks performed by the Chromecast API when handling external content, enabling the attacker to read protected data from the renderer. Consequently, user data is disclosed within the compromised process. Chromium rates this vulnerability as having medium security severity.

Google Chrome versions prior to 156.0.8078.47 on all platforms that include the Chromecast component are affected.

The CVSS score of 8.8 signals a high severity vulnerability. The EPSS score of < 1% indicates a very low probability of exploitation, and the issue is not listed in KEV. Exploitation is possible through a malicious web page that uses the Chromecast API to gain privileged access, allowing the attacker to read sensitive information from the renderer process. The likely attack vector remains a crafted HTML page that targets the vulnerable component via the Chromecast API.