The weakness arises from an inadequate check in the Chromecast implementation in Google Chrome. When an attacker has already compromised the renderer process, they can deliver a specially crafted HTML page that causes the browser to bypass navigation restrictions. The flaw permits enforcement of navigation limits to be overridden, potentially allowing the attacker to direct users to unintended destinations without their consent. This weakness aligns with CWE‑20, which deals with improper input validation or sanitization that allows an attacker to influence program behavior.

This issue affects Google Chrome versions earlier than 150.0.7871.47 on any platform that includes the Chromecast component. The vulnerability exists in the Chromecast functionality of Chrome and applies to all builds released prior to the fix.

The CVSS score of 6.5 indicates medium severity, and the EPSS score of less than 1% reflects a low probability of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already have control over the renderer process; once that condition is met, the attacker can use it to circumvent navigation restrictions but does not grant unrestricted access to the system.