A memory corruption bug exists in Google Chrome's Media component before version 156.0.8078.73. The flaw allows a maliciously crafted HTML page to overwrite bounds in memory, potentially granting an attacker arbitrary code execution within Chrome’s sandbox environment. Because the sandbox can be compromised, privilege escalation or system compromise is possible, especially on systems where Chrome runs with elevated privileges or is allowed to access sensitive data.

All installations of Google Chrome that are built before version 156.0.8078.73, regardless of operating system, are susceptible. The issue is tied to the stable channel releases that incorporate the vulnerable Media module.

The vulnerability can be triggered from any network accessible webpage. Attackers need only host or embed a specially crafted HTML payload on an arbitrary site. While no EPSS score is currently available and the vulnerability is not featured in CISA's KEV catalog, Chromium's internally logged severity is high, indicating that exploitation is plausible. The lack of an EPSS metric does not invalidate the risk; the flaw requires no additional pre‑conditions beyond a vulnerable browser instance.