An inappropriate implementation in the Media component of Google Chrome before version 148.0.7778.216 allows a remote attacker to bypass the same-origin policy through a carefully crafted video file. The flaw enables the attacker to access resources and execute scripts from domains that the victim’s browser normally protects, potentially leading to data theft or unauthorized code execution. The weakness is a form of improper access control, as described by CWE-346.

Google Chrome desktop clients running any operating system, on any platform, on versions prior to 148.0.7778.216 are affected. The vulnerability applies to media handling of video files delivered to the browser.

Chromium classifies this issue with high severity, reflected by a CVSS score of 9.3. The likely exploitation vector is a remote attacker who can host or serve a malicious video file that the victim’s Chrome downloads or plays. The EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. Given this high severity rating, the risk of exploitation is significant if an attacker can supply the crafted file to a user’s Chrome browser. No public exploit is currently documented, but the attack could be automated once the media decoding chain is triggered.