Insufficient validation of untrusted media input in Google Chrome allowed a remote attacker who had already compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. The weakness is an input validation flaw (CWE‑20, CWE‑1289) that enables remote code execution under sandboxed conditions, potentially allowing an attacker to gain significant privileges within the browser context.

Google Chrome, all versions prior to 149.0.7827.53, which are affected by the media component input validation bug.

This vulnerability has a CVSS score of 8.8, classifying it as high severity. The EPSS score of 0.00106 indicates a very low but non‑zero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no current public exploitation yet. The likely attack vector is a malicious HTML page served to users, and exploitation requires an attacker who can compromise the renderer process, which is typically achieved through social engineering or infected sites. Because the flaw is limited to the sandbox, the overall risk to the host is reduced, but within the browser, arbitrary code execution can lead to significant compromise.