The vulnerability is an inappropriate implementation in the Cast feature of Google Chrome on Android that allows a remote attacker to bypass the same origin policy through a crafted HTML page. This flaw permits a malicious web page to access resources that should be restricted, potentially exposing sensitive information or enabling further attacks on the device. The Chromium severity label for this issue is Low, and the vulnerability is categorized under CWE-346, reflecting a bypass of authentication or authorization controls.

The affected product is Google Chrome for Android, versions prior to 151.0.7922.72. Users running any earlier release on an Android device are vulnerable.

The CVSS score of 4.3 indicates low severity, and the EPSS score of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to lure the victim into opening a crafted HTML page in Chrome, which the same origin policy should normally block, allowing the attacker to read or manipulate data from the victim’s browser context.