An integer overflow occurs in the Media component of Google Chrome, allowing a remote attacker to execute arbitrary code inside the browser sandbox. The flaw is triggered by a malicious file and is classified as high severity by Chromium security. If exploited, the attacker can bypass the sandbox and run code with the privileges of the browser process.

All users running Google Chrome versions earlier than 149.0.7827.53 are affected. This includes the stable channel releases prior to the update announced in June 2026.

The exploit requires a remote attacker to supply a crafted media file that causes the overflow. The EPSS score indicates a very low, but non-zero, exploitation probability (<1%) and the vulnerability is not listed in the CISA KEV catalog, but the high severity rating (CVSS 8.8) and the ability to escape sandbox isolation indicate a significant security risk. Because the flaw leads to arbitrary code execution, the attacker could potentially compromise the underlying operating system if additional privilege escalation steps are successful.