A race condition in the media codecs of Google Chrome on Windows enables a remote attacker, once they have compromised the renderer process, to potentially escape the sandbox through a specially crafted HTML page. This flaw is classified as CWE‑362 and CWE‑368 and could allow the attacker to execute arbitrary code with elevated privileges on the host system.

The vulnerability affects Google Chrome for Windows versions earlier than 149.0.7827.53. Users running these builds are susceptible if a malicious page can obtain renderer process compromise.

The CVSS score is 8.3, which indicates high severity, and the EPSS score is < 1%, indicating a very low but non-zero probability of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires an attacker to first gain control of the renderer process, which is a significant prerequisite, meaning that, while the potential impact is severe, the likelihood of a successful attack in the wild remains limited without prior compromise.