Technical impact
Google Chrome's codec system failed to properly validate untrusted input from video files in versions preceding 147.0.7727.55, allowing a crafted file to trigger an out‑of‑bounds memory access. This weakness, categorized as insufficient input validation (CWE‑20), could corrupt the browser's memory but has not been shown to provide direct data disclosure or remote code execution.
Affected Systems
All installations of Google Chrome older than version 147.0.7727.55 are susceptible, regardless of operating system, because the vulnerability resides in the core codec component used across Desktop channels.
Risk and Exploitability
With a CVSS score of 4.3, the risk is considered low. The vulnerability is not present in CISA's KEV catalog, and no EPSS data is available, indicating a modest exploitation probability. An attacker would typically deliver a malicious video file, either by hosting it on a compromised website or sending it through another channel, and opening it in the vulnerable browser. While the fault currently results only in memory corruption, a skilled adversary might chain it with other weaknesses to achieve higher privileges or persistence.
