An out‑of‑bounds read vulnerability in Chrome’s media component can be triggered by a crafted HTML page, allowing a remote attacker to potentially execute arbitrary code within the browser sandbox. This flaw is a classic example of CWE‑125, where data is accessed beyond the bounds of an allocated buffer, leading to memory corruption and code execution.

The issue affects Google Chrome versions prior to 157.0.8103.38. All installations of the stable desktop channel that have not yet been updated to this or later releases are vulnerable.

The vulnerability has a high safety impact, but its exploitation likelihood remains uncertain due to the absence of an EPSS score; it is not listed in CISA’s KEV catalog. An attacker would need to host or deliver a malicious HTML page to a victim’s browser, making the attack vector typical of network‑based exploitation. Because the flaw is within sandboxed code, successful exploitation could allow the attacker to escape the sandbox and gain broader system access.