This vulnerability involves an inappropriate implementation in the Cast feature of Google Chrome before version 151.0.7922.72. It enables a remote attacker to leak data across origins by crafting a malicious HTML page. The CVSS score is 4.3 (medium severity), reflecting that the attack vector is network-based, requires no privileges, but does require user interaction, and impacts confidentiality only. There is no indication of active exploitation in the wild. The vendor advisory URL is provided but does not explicitly state the patch status or remediation level.

The vulnerability allows remote attackers to leak cross-origin data, potentially exposing sensitive information from other origins. It does not affect data integrity or availability. Exploitation requires user interaction, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Users and administrators should monitor for updates to Chrome version 151.0.7922.72 or later that address this issue.