The vulnerability is caused by insufficient validation of untrusted input in Chrome's codec implementation, allowing a maliciously crafted video file to escape the renderer sandbox. This could give an attacker the ability to execute code with higher privileges than the browser normally allows, potentially compromising the entire system.

Google Chrome is the affected vendor and product. Versions before 149.0.7827.53 are vulnerable, as stated in the official description. No other vendors are mentioned.

The CVSS score of 9.6 categorizes this issue as critical, and the EPSS score of less than 1% indicates a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a maliciously crafted video file delivered via a web page, email attachment, or other media that the user interacts with. If the victim opens or processes the file, a sandbox escape could occur, giving the attacker elevated privileges within the browser context and potentially beyond.