An insufficient validation of untrusted input in the Cast component of Google Chrome allows an attacker who can send malicious network traffic from the same local network segment to read cross‑origin data. The flaw is a classic input validation weakness (CWE‑20) combined with a security misconfiguration (CWE‑346) that leads to a privacy breach. The impact is the disclosure of sensitive content that was intended to be isolated from the attacker’s origin, which can include user data such as cookies, text, or media.

Google Chrome browsers on all supported operating systems that rely on the Cast feature and whose installed version is older than 151.0.7922.72 are affected. This includes Windows, macOS, and Linux builds that enable local Cast traffic to browsers on the same network.

The CVSS score of 4.3 classifies the vulnerability as medium risk, while an EPSS score of less than 1% indicates a very low probability of real‑world exploitation. The flaw requires an attacker to be on the same local network and to send crafted Cast traffic, which limits the attack surface. The vulnerability is not listed in the CISA KEV catalog, further suggesting that no widespread, actively used exploits are known.