The vulnerability stems from insufficient validation of untrusted input within the Cast component of Google Chrome. A malicious web page can supply crafted HTML to the Cast subsystem, enabling a remote attacker to circumvent the browser’s same‑origin policy. This can lead to cross‑origin data theft or execution of scripts in the victim’s context, compromising confidentiality and potentially allowing further exploitation. The weakness is an input validation flaw (CWE‑20).

Google Chrome browsers with versions before 151.0.7922.72 are affected. Users running any earlier stable release are at risk until they upgrade to the patched version or later.

The assigned CVSS score of 4.3 indicates moderate risk, yet the EPSS score of less than 1% signals a low probability of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need to entice a victim to visit a malicious page that interacts with the Cast feature; if they succeed, same‑origin restrictions can be bypassed, potentially exposing sensitive data or enabling further attacks. The conditions for exploitation are remote and straightforward: crafted input delivered to the browser through an HTTP(S) page.