This vulnerability arises from an improper check in Chromecast within Google Chrome, enabling an attacker who has already compromised the rendering engine to serve a specially crafted HTML page that can override navigation limits. The flaw allows the attacker to reform navigate controls, thereby potentially redirecting users or triggering unintended actions without their consent. The weakness falls under CWE‑20, reflecting unsafe handling of input that bypasses defined security constraints.

The issue affects Google Chrome versions prior to 150.0.7871.47 on all platforms that use the Chromecast component. Users running these earlier builds with the Chromecast feature enabled are at risk.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of <1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, showing limited public exploitation evidence. The attack requires prior compromise of the renderer process, a condition that is generally harder to achieve than a simple remote request; however, once achieved, the attacker can immediately bypass navigation restrictions. The Chromium severity is labeled Medium, suggesting that the flaw is significant but may not provide immediate full system compromise without additional foothold.