An input validation flaw (CWE-20) in Google Chrome’s media handling allows a sandbox escape if the renderer process is already compromised. When exploited, the attacker can execute code with the privileges of the current user, effectively elevating local privileges and potentially compromising confidentiality, integrity, and availability of the machine.

All installations of Google Chrome on Windows older than version 150.0.7871.47 are impacted. The vulnerability resides in the Media code path, so any renderer process that processes media content is susceptible.

The flaw is rated high severity, with a CVSS score of 9.6, indicating a critical risk. The EPSS score indicates a very low probability of exploitation and the vulnerability is not listed in CISA’s KEV catalog. The attack requires the attacker to first gain control of a renderer process, after which the media input validation failure can be leveraged to escape the sandbox. The likely attack vector is a malicious web page that first exploits a renderer‑process compromise and then abuses the media flaw to escape the sandbox.