This vulnerability arises from insufficient validation of untrusted input within the Cast feature of Google Chrome versions prior to 149.0.7827.53. Exploiting this flaw, a remote attacker can bypass the browser's same origin policy, potentially allowing unauthorized access to web content from different origins. The issue is classified with low severity by the Chromium security team. The vulnerability was publicly disclosed on June 4, 2026, and Google has released a stable channel update to remediate it.

The impact is a bypass of the same origin policy, which is a fundamental security control in web browsers designed to prevent malicious web pages from accessing data from other origins. Although this can lead to unauthorized data access, the Chromium team rates this vulnerability as low severity, indicating limited risk or difficulty in exploitation. No known exploits have been reported in the wild.

A fix is available in Google Chrome version 149.0.7827.53 and later. Users and administrators should update to this version or a more recent one to remediate the vulnerability. Since this is a client-side application, patching the browser is the primary mitigation step. There is no indication from the vendor advisory that additional actions are required.