Google Chrome’s Cast functionality validated untrusted network input without sufficient checks, a CWE‑20 flaw, and a CWE‑346 flaw. This combination allowed an attacker on the same local network segment to bypass the browser’s same origin policy. The weakness means the policy that normally isolates web content could be circumvented, permitting a malicious source to interact with pages from a different origin in the victim’s browser context.

The issue affects Chromium‑based Google Chrome desktop browsers earlier than version 148.0.7778.96. Any installation that includes the Cast component is impacted, regardless of operating system, as the vulnerability resides in the Cast network handling code.

The CVSS score is 4.3, indicating low to moderate severity. The EPSS score of <1% indicates a very low but non‑zero probability of exploitation. The vulnerability stems from CWE‑20 input validation and CWE‑346 code injection weaknesses, requiring a local attacker on the same network segment to send crafted network traffic that the Cast module processes; no internet‑wide exploitation is described. The flaw is not listed in CISA’s KEV catalog.