An uninitialized use in certain Chrome codecs allows an attacker who already gained control of the renderer process to potentially escape the sandbox and execute code outside the browser’s trusted environment. This flaw corresponds to CWE‑457 and CWE‑824 and is rated as high severity by Chromium. The impact would expose any data or code that the browser can access, effectively compromising the user’s system if further exploitation succeeds.

Google Chrome versions prior to 149.0.7827.53 are affected. Users of the stable channel running any older revision of Chrome are at risk unless they upgrade past the specified patch level.

The vulnerability is only exploitable against a renderer process that has already been compromised. No public exploit path is described, and the EPSS score of < 1% indicates a very low probability of exploitation activity. The CVE is not listed in CISA’s KEV catalog. The CVSS score of 8.3 indicates a high risk once the attacker can control the renderer. An attacker would need to deliver a crafted HTML page that triggers the faulty codec path to initiate the sandbox escape.