Inappropriate handling of codec parameters in Google Chrome allows a remote attacker to craft a malicious video file that can escape the browser sandbox, potentially leading to arbitrary code execution on the host. The weakness is a failure to validate input data, categorized as CWE‑20. Attackers can embed the malformed file in a web page or deliver it through other remote vectors.

The flaw affects Google Chrome browsers before the release of 149.0.7827.53. Users running any older stable channel version are vulnerable. No additional product or version details are provided, so the advisory covers all versions less than 149.0.7827.53 on supported operating systems.

Because sandbox escape grants kernel‑level access, the risk is high. No EPSS score is available, and the vulnerability is not listed in CISA KEV, but the severity is marked high by Chromium. The likely attack pathway is a malicious video file served over the network, executed by a user or a background process. Once sandboxed code is altered, the attacker can write files, read protected memory, and take control of the system.