Technical impact
Inappropriate handling of codec parameters in Google Chrome allows a remote attacker to craft a malicious video file that can escape the browser sandbox, potentially leading to code execution on the host. The weakness is a failure to validate input data, categorized as CWE‑20 and CWE‑1286. Attackers can embed the malformed file in a web page or deliver it through other remote vectors.
Affected Systems
The flaw affects Google Chrome browsers before version 149.0.7827.53. Users running any older stable channel version are vulnerable. No additional product or version details are provided, so the advisory covers all versions less than 149.0.7827.53 on supported operating systems.
Risk and Exploitability
The CVSS score of 9.6 indicates that exploitation could allow code execution outside the browser sandbox. The EPSS score of <1% shows a low probability of exploitation, and the vulnerability is not listed in CISA KEV. Chromium classifies the issue as high severity. The likely attack vector is a remote attacker delivering a crafted video file to the target, which the browser processes, potentially leading to code execution with the privileges of the user process.
Debian DSA