Google Chrome’s Cast functionality validated untrusted network input without sufficient checks, a CWE‑20 flaw, allowing an attacker on the same local network segment to bypass the browser’s same origin policy. This weakness means the policy that normally isolates web content could be circumvented, permitting a malicious source to interact with pages from a different origin in the victim’s browser context.

The issue affects Chromium‑based Google Chrome desktop browsers earlier than version 148.0.7778.96. Any installation that includes the Cast component is impacted, regardless of operating system, as the vulnerability resides in the Cast network handling code.

The CVSS score is 4.3, indicating low to moderate severity. No EPSS data is provided, so the likelihood of exploitation remains undefined. The vulnerability requires a local attacker on the same network segment to send crafted network traffic that the Cast module processes; no internet‑wide exploitation is described. The flaw is not listed in CISA’s KEV catalog.