The vulnerability arises from insufficient validation of untrusted media content in Chrome's renderer component. A crafted HTML page can supply unsuitable input that the renderer process accepts without proper checks. An attacker who has already compromised the renderer process can use this flaw to escape the sandbox, gaining higher privileges on the host system. This flaw is mapped to CWE‑20, improper input validation.

Google Chrome versions earlier than 149.0.7827.53 on desktop platforms are affected. The problem is specific to the media handling code path in these releases.

The CVSS score of 8.3 indicates a high severity. EPSS score is not available and the vulnerability is not listed in CISA KEV, so there is no publicly known widespread exploitation. Nonetheless, because the flaw requires a compromised renderer and a maliciously crafted page, an adversary capable of delivering such content can leverage the sandbox escape to execute code with the privileges of the renderer. Prompt patching mitigates the risk.