An out-of-bounds write flaw in the Media components of Google Chrome used to exist before version 155.0.8059.39. The defect lets an attacker, via a specially crafted web page, write data beyond intended bounds in memory that may break the browser’s sandbox and allow arbitrary code execution outside that protected environment. The vulnerability is a classic example of CWE-787, which indicates an unsafe buffer access can corrupt memory and compromise confidentiality and integrity on the affected system.

Google Chrome users running any release older than 155.0.8059.39 are affected. This includes all desktop platforms that ship older stable channel builds of Chrome. No other products or browsers are listed as impacted.

The CVSS score of 9.6 indicates a very high severity, while the Chromium security severity is reported as Medium. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been exploited in the wild. However, parenthetically, the malformed HTML required to trigger the flaw can be delivered over standard HTTP or HTTPS, so a web page can serve as the attack vector. Because the flaw permits code execution outside a sandbox, any successful exploitation would grant the attacker full control over the user’s machine.