This vulnerability in Google Chrome's Cast component arises from insufficient validation of untrusted input, enabling a remote attacker to bypass the same origin policy by delivering a specially crafted HTML page. The issue affects versions of Chrome before 149.0.7827.53. The weakness is categorized under CWE-20 (Improper Input Validation). Although the CVSS base score is 4.3 (medium severity), no known exploits are reported in the wild. The vendor advisory linked does not explicitly confirm a patch or remediation status.

Successful exploitation could allow an attacker to bypass the same origin policy, potentially enabling limited unauthorized interactions between web origins. The impact is rated medium with no direct confidentiality or availability impact reported, only integrity impact is noted.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should update to Chrome version 149.0.7827.53 or later once available and follow any vendor instructions.