The flaw comes from insufficient validation of untrusted input in Chrome's Codecs component. A remote attacker who has already compromised the renderer process can deliver a specially crafted HTML page that forces the renderer to run code outside its sandbox. Successful escape would grant the attacker the same privileges as the renderer process, effectively enabling arbitrary code execution on the user's machine.

Google Chrome browsers running any version older than 149.0.7827.53 are affected. The vulnerability was fixed in the stable channel release 149.0.7827.53 and later. No other vendors or products are listed.

The CVSS score is medium, and the EPSS score is not available, indicating that no high exploitation probability has been quantified yet. The flaw is not listed in the CISA KEV catalog, but a sandbox escape still represents a serious attack surface for any user who opens potentially malicious HTML content. Exploitation requires that the attacker first compromise the renderer process, which limits the scope of the vulnerability but introduces a significant risk for compromised content. The likely attack vector is a crafted HTML page delivered over the network, exploiting the renderer in a local browser context.