Insufficient validation of untrusted media input in Google Chrome prior to 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to craft a malicious video file that can lead to a sandbox escape. This input validation flaw (CWE‑20) could enable the attacker to execute code outside the browser sandbox, potentially compromising the entire host system.

Google Chrome browser versions earlier than 150.0.7871.47 are affected on all platforms that support media rendering. The vulnerability lies in the renderer process; therefore any operating system where Chrome runs is potentially vulnerable.

The CVSS score of 9.6 indicates a high severity vulnerability, yet the EPSS score of < 1 % suggests a low likelihood of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, the attacker must first gain control of the renderer process—likely via a malicious web page or another exploit—before delivering a crafted video file that triggers the validation failure and allows the renderer to escape its sandbox. Thus the likely attack path requires a two‑step exploit: initial renderer compromise followed by delivery of malicious media.