In Google Chrome versions prior to 151.0.7922.72, the Cast feature was implemented incorrectly, allowing a remote attacker to construct a specialized HTML page that accesses and leaks data from other origins. This flaw manifests as a confidentiality breach, exposing sensitive information without authentication. The weakness is categorized as CWE‑346, reflecting flaws in authority delegation or capability‑based authorization.

Affected systems include Google Chrome running on any platform, specifically versions before 151.0.7922.72. Users with newer releases are not impacted, and no specific version ranges beyond the stated cut‑off are required for vulnerability assessment because the issue has been fixed in the listed release.

The CVSS score of 4.3 and an EPSS score of less than 1% indicate moderate severity and a low likelihood of widespread exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog, further suggesting limited active exploitation. An attacker can trigger the data leak by hosting a crafted HTML page that the victim visits, leveraging the Cast component to read cross‑origin data and exfiltrate it.