A heap buffer overflow occurs in the Video component of Google Chrome before version 149.0.7827.53. The weakness corresponds to CWE-122 (Heap-based Buffer Overflow) and CWE-131 (Incorrect Calculation of Buffer Size). If an attacker serves a specially crafted HTML page that forces the renderer process to overflow, the overflow can trigger a sandbox escape. This vulnerability is rated high severity by Chromium.

The vulnerability affects Google Chrome on desktop systems running any stable channel release older than 149.0.7827.53. Versions 149.0.7827.53 and later contain the fix and are not susceptible to the overflow.

The CVSS score of 8.3 indicates high severity. The EPSS score of 0.00062 indicates a very low probability of exploitation in the wild, and the flaw is not listed in the CISA KEV catalog. The attack requires compromise of the renderer process, implying a higher effort. The potential for sandbox escape poses significant risk for users of affected Chrome versions.