The vulnerability is a use‑after‑free in the media codecs component of Google Chrome on Windows. When a renderer process is compromised, a specially crafted HTML page can trigger access to freed memory, potentially allowing the attacker to escape the sandbox and execute arbitrary code within the user’s operating system.

Any Windows build of Google Chrome before version 149.0.7827.53, including the desktop channel, is affected.

EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, which indicates limited known exploitation. Still, because the exploit would enable a sandbox escape, success would give an attacker high privileges and remote code execution. The attack requires the attacker to already compromise the renderer process and deliver a malicious HTML page, so the impact is confined to environments where this control can be achieved. Chromium rated the severity as medium.