The vulnerability is a buffer access error in Chrome’s media subsystem that can be triggered by a crafted HTML file. The flaw allows a remote attacker to write or read beyond defined memory bounds, enabling execution of arbitrary code inside the browser’s restricted sandbox. The weakness is reflected by CWE‑119, indicating improper bounds checking. Because code runs inside the sandbox, an attacker could potentially expand privileges within that environment or hijack browser processes.

Affected systems are those running Google Chrome versions older than 156.0.8078.73. All desktop releases of Chrome in the stable channel below this version are vulnerable. The issue originated in the Chromium media library and applies to browsers on Windows, macOS, and Linux platforms.

The CVSS severity is classified as High, and no EPSS score is available, indicating no publicly known exploitation rate at present. The vulnerability is not yet in CISA’s KEV catalog. The attack likely requires the user to open a malicious HTML page that exercises the media component. Once triggered, arbitrary code can run within the sandbox, posing a significant risk to the user’s data and system integrity. Enterprises should treat this as a priority patching issue due to its high severity and the remote nature of the attack vector.