An insufficient validation of untrusted input in the Cast component of Google Chrome allows an attacker on the same local network segment to trigger the transmission of cross‑origin data. The flaw would enable the attacker to read confidential data that was not intended to be exposed, resulting in a data‑leak scenario. The weakness is classified as CWE‑20 and CWE‑346, reflecting improper input validation and error handling. It is rated Medium in Chromium’s own severity scale.

The vulnerability affects Google Chrome browsers prior to the 151.0.7922.72 release. Users running any earlier version using the Cast feature are susceptible. The problem is bound to the Cast module, so disabling or removing that feature mitigates exposure. No other products are listed as affected.

The CVSS score of 4.3 indicates a medium impact. The EPSS score of <1% shows the probability of exploitation remains very low, and the issue is not yet featured in the CISA KEV catalog. The attack vector is local, as it requires the attacker to be on the same network segment and to send crafted Cast traffic. Because exploitation requires the victim to have the Cast feature enabled, the risk is limited to environments where casting is used. Nonetheless, defenders should consider patching when available.