This vulnerability in Google Chrome's Cast feature arises from insufficient validation of untrusted input, enabling a remote attacker to bypass the same origin policy by crafting a malicious HTML page. The issue affects versions prior to 149.0.7827.53. The CVSS 3.1 base score is 6.5, reflecting a network attack vector with low attack complexity, no privileges required, user interaction needed, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

An attacker can bypass the same origin policy, potentially allowing unauthorized modification of data or actions within the browser context, impacting data integrity. There is no reported impact on confidentiality or availability. This could facilitate attacks that rely on manipulating web content or scripts across origins.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and consider limiting use of the Cast feature if feasible.