Insufficient policy enforcement in Chromecast allows an attacker on the local network to inject scripts or HTML into a privileged page through malicious network traffic. The flaw is a cross‑site scripting weakness (CWE‑79). An attacker can run arbitrary code within the context of the privileged page, potentially compromising the user’s credentials or exfiltrating data. The impact is limited to the local machine and requires the attacker to be on the same network segment, but the injected code could be used to manipulate browser state or access local resources.

Google Chrome browsers on desktop platforms running versions earlier than 151.0.7922.72 are affected. The vulnerability is specific to the Chromecast feature embedded in Chrome and does not apply to other browsers or devices. All users of the affected Chrome releases that are connected to the local network are potentially exposed.

The CVSS score of 5.4 classifies the flaw as low severity, and the EPSS score of less than 1% indicates an extremely low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local‑network traffic; therefore, an attacker must be able to send crafted packets to the target machine. While the risk is low, the presence of the flaw means that an attacker could gain significant leverage within a compromised local environment if the attacker can send malicious data to the user’s Chrome instance.