An inappropriate implementation of the WebAudio API in Google Chrome versions prior to 150.0.7871.182 permits a remote attacker to execute arbitrary code inside a sandboxed environment through a specially crafted HTML page. The bug stems from improper input validation (CWE-20) and has been classified as high severity by Chromium’s internal security assessment. The execution occurs within the browser’s sandbox, so the attacker’s code is confined to the limited privileges granted to that environment and does not immediately lead to full system compromise.

Google Chrome desktop builds older than 150.0.7871.182 are affected; this includes all desktop platforms running a pre‑150.0.7871.182 build.

The CVSS score of 8.8 reflects a high severity, while an EPSS score of less than 1% indicates a low current likelihood of active exploitation and the vulnerability is not listed in CISA’s KEV catalog. Attackers must only lure a victim into loading the malicious web page; no local privileges or additional resources are required. If exploited, the attacker gains code execution confined to the browser’s sandbox, but does not escape to broader system privileges.