This vulnerability arises from insufficient validation of untrusted input within the Chromecast functionality of Google Chrome versions before 150.0.7871.47. An attacker with control over the renderer process could leverage this flaw to perform a sandbox escape, which could lead to execution of arbitrary code with elevated privileges. The CVSS 3.1 base score of 9.6 reflects network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability. The issue is publicly disclosed with a vendor advisory link but lacks explicit patch or remediation confirmation.

Successful exploitation could allow a remote attacker who has already compromised the renderer process to escape the sandbox protections, potentially leading to full system compromise. This affects the confidentiality, integrity, and availability of the affected system. No confirmed exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution with untrusted content and consider disabling Chromecast features if feasible.