The vulnerability stems from insufficient enforcement of media device access policies in Chrome’s GetUserMedia API, categorized as a CWE‑346 Same‑Origin Policy Bypass. It allows a remote attacker to craft an HTML page that, when loaded in a victim’s browser, makes Chrome ignore the same‑origin restriction and grant a script access to media streams that should only be available to the requesting origin. The impact is that an attacker can read audio or video data from a trusted origin without the user’s knowledge, potentially exposing private communications, but it does not provide arbitrary code execution.

Google Chrome versions earlier than 150.0.7871.47 on all supported operating systems are affected. The issue exists across mobile and desktop builds until the update is applied.

Chromium rates this flaw as low severity with a CVSS score of 4.3. The EPSS score is less than 1 % and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to host a specially crafted web page that a victim must visit; the flaw does not provide a direct path to code execution, limiting the damage to a policy breach wherein cross‑origin media stream data may be harvested.