Incorrect reference resolution in the MediaStream API of Google Chrome allows a remote attacker to craft a malicious HTML page that bypasses the web origin policy, enabling access to privileged pages. This flaw is classified as CWE-706, representing unauthorized access to privileged functions, and is rated as medium severity.

Google Chrome users running versions prior to 154.0.8037.57 are affected. The flaw is present in all Chrome releases before that patch, so any user of the stable, beta, or dev channels below that revision is vulnerable.

The EPSS score of < 1% and the CVSS score of 6.5 indicate moderate severity, and it is not listed in the CISA KEV catalog. The exploit requires the victim to open a crafted HTML page, which a remote attacker can supply over the web. The attack vector is a remote web page, and no privileged execution or local system compromise is needed; however, the attacker gains access to privileged pages normally restricted by origin checks. The median severity suggests moderate risk and attackers could leverage the vulnerability to elevate privileges within the browser context.