An out‑of‑bounds read and write flaw was identified in the Media component of Google Chrome for macOS. The bug allows a remote attacker who has already compromised the renderer process to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The impact is the execution of code with the privileges of the sandboxed renderer, potentially enabling privilege escalation or further compromise of the user system.

The vulnerability affects Google Chrome running on macOS versions prior to 149.0.7827.103. Users of any earlier releases of Chrome on Mac are therefore at risk until a patched version is installed.

Chromium classifies the issue as high severity, reflected by a CVSS score of 7.5. The EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to deliver a malicious HTML page to the renderer process, which is typically constrained to sandbox permissions; the out‑of‑bounds read/write enables arbitrary code execution within that confined environment, and this delivery method is inferred from the description.