Chromium’s Chromecast component performs insufficient validation on untrusted input received in a crafted HTML page. A remote attacker who has already compromised the renderer process can use this flaw to escape the renderer sandbox, potentially gaining unrestricted code execution on the host. The vulnerability is linked to input validation errors (CWE-20) and insufficient sandboxing controls (CWE-1289).

Google Chrome browsers on desktop platforms may be affected. No specific version range is delineated in the advisory, but the issue is known to exist in releases prior to 151.0.7922.72.

The CVSS score of 9.6 indicates a critical severity rating, yet the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation has been documented. The attack requires control of the renderer process, so an attacker would first need to compromise or trick the browser into loading malicious content before the sandbox escape can occur.