The vulnerability is a heap buffer overflow in the codecs component of Google Chrome. When a user loads a specially crafted HTML page, memory corruption can occur during media decoding, allowing a remote attacker to execute arbitrary native code inside the browser’s sandbox. Because execution is confined to the sandbox, the impact is limited to the browser environment, but the flaw still permits arbitrary code execution within that context.

Google Chrome installations with a version earlier than 151.0.7922.72 are vulnerable. The issue applies to any platform where the browser runs, as it is not specified to a particular operating system or distribution.

The CVSS score of 8.8 indicates a high severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the field. The attacker must supply a malicious HTML page that a user visits, providing a remote attack vector. Because the exploit is sandbox‑bound, the effective impact is largely contained within the browser, though any escape from the sandbox would increase potential damage. The vulnerability is not listed in the CISA KEV catalog.