An out‑of‑bounds read bug exists in the Media component of Google Chrome that allows a remote attacker to manipulate a crafted HTML page and potentially execute arbitrary code inside the browser's sandbox. This flaw is classified as CWE‑125 and, according to Chromium's own assessment, carries a medium severity rating. If successfully exploited, the attacker could gain access to user data or carry out further malicious activity within the sandboxed environment.

Google Chrome desktop browsers running any version earlier than 157.0.8103.38 are affected. The vulnerability applies across all operating systems supported by Chrome and can be triggered by any web page that loads media content.

EPSS data is not available and the vulnerability is not listed in CISA's KEV catalog, implying no confirmed exploitation at this time. However, the attack vector is inferred to be remote and high‑impact, relying on a victim opening a malicious HTML page that includes crafted media references. The absence of a CVSS score in the public data suggests that the severity is determined by Chromium's internal metrics rather than an external risk score, but the potential for code execution warrants immediate remediation.