This vulnerability in Google Chrome's Chromecast feature allows an attacker on the same local network segment to perform script or HTML injection into a privileged page by exploiting insufficient policy enforcement. The issue affects versions prior to 151.0.7922.72. The CVSS vector indicates the attack requires local network access with low attack complexity and no privileges or user interaction needed. The impact includes limited confidentiality and integrity loss but no availability impact. The vulnerability is categorized under CWE-79, indicating cross-site scripting or similar injection flaws. The vendor advisory link is provided but does not explicitly state patch or remediation details.

An attacker on the local network can inject malicious scripts or HTML into privileged pages within Chrome's Chromecast feature, potentially leading to limited confidentiality and integrity compromise. There is no indication of availability impact or widespread exploitation. The attack requires local network access, limiting the attack surface.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html for current remediation guidance. Until official confirmation, users should update to version 151.0.7922.72 or later once available. No specific temporary mitigations are documented.