The vulnerability stems from insufficient enforcement of media device access policies in Chrome’s GetUserMedia, a weakness classified as CWE-346. A crafted HTML page can cause Chrome to ignore the same‑origin policy, permitting cross‑origin media stream access that should be restricted.

Google Chrome versions prior to 150.0.7871.47 on all operating systems are affected until the update is applied.

Chromium’s internal severity for this issue is low. The EPSS score is < 1 % and this vulnerability is not listed in CISA’s KEV catalog, while the CVSS score of 4.3 indicates low severity. The likely attack vector requires an attacker to host a specially crafted web page that a victim visits; because the flaw does not provide a direct code‑execution path, exploitation is limited to the policy breach. Based on the description it is inferred that the attacker could gain unauthorized cross‑origin access to media streams, however this is not explicitly confirmed in the CVE text.