The flaw resides in Chrome’s Codecs component, where untrusted input is insufficiently validated. A remote attacker who has already compromised the renderer process can deliver a specially crafted HTML page that compels the renderer to execute code outside its sandbox. Based on the description, it is inferred that the attacker could run code with the same privileges as the renderer, effectively escaping its sandbox, though this does not guarantee arbitrary system-wide code execution.

Google Chrome browsers with a version older than 149.0.7827.53 are affected. The vulnerability was fixed in the stable channel release 149.0.7827.53 and later. No other vendors or products were listed.

The CVSS score is 9.6, indicating a high‑severity vulnerability. The EPSS score of <1% suggests a low exploitation probability, yet the severity remains significant. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process, which limits the attack surface but still poses a serious risk for compromised content. The likely attack vector is a crafted HTML page delivered over the network, targeting the renderer in a local browser context. In this context, the vulnerability would enable a sandbox escape.