An insufficient validation of untrusted input in Chrome’s media handling path allows a malicious attacker who has already gained control of a renderer process to craft an HTML page that can trigger a sandbox escape. The weakness is an input validation flaw (CWE‑20) combined with improper media handling (CWE‑1289), giving the attacker the ability to execute code with privileges outside the confined renderer environment and potentially compromise the host operating system’s confidentiality and integrity.

Desktop versions of Google Chrome prior to 149.0.7827.53 are vulnerable on all major operating systems that run that build, including Windows, macOS, and Linux. Any user running an older build of Chrome could be affected if a renderer process is compromised.

The CVSS score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests the likelihood of widespread exploitation is low but not negligible. The vulnerability is not listed in the CISA KEV catalog, but it remains a critical concern because it requires a foothold in the renderer process before exploitation. If exploited, the sandbox escape can lead to full system compromise, creating a significant risk for affected users.