An out‑of‑bounds write vulnerability exists in the video codec component of Google Chrome that can be triggered by a specially crafted video file. This buffer overflow (CWE‑787) may allow a remote attacker to escape the browser sandbox and potentially execute arbitrary code with higher privileges.

Google Chrome versions earlier than 149.0.7827.53 are affected. Users running these versions, on any supported operating system, remain vulnerable until the patch is applied.

The Chrome team rates the issue as a high‑severity vulnerability with a CVSS score of 9.6, indicating a critical risk for users of vulnerable Chrome versions. Exploitation requires the victim to open or render the malicious video file, representing a remote attack vector. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting limited current exploitation, yet the potential for sandbox escape remains a substantial threat to user data and system integrity.