Heap buffer overflow in several video and audio codecs within Google Chrome allows a crafted HTML page to overwrite heap memory, potentially enabling arbitrary code execution on the host. The overflow is triggered by malformed codec data; if exploited, it could give an attacker full control over the user's system, compromising confidentiality, integrity, and availability. This weakness is characterized as CWE‑122 (Heap-based Buffer Overflow) and CWE‑787 (Use After Free).

Google Chrome users whose browser version is earlier than 145.0.7632.45 on any supported platform—Windows, macOS, or Linux—are affected. The issue arises in all installations that include the vulnerable code paths for codec processing, regardless of the operating system.

The CVSS base score is 8.8 and the EPSS score is 4%, indicating a high severity but a moderate current exploitation probability. The flaw is not listed in the CISA KEV catalog, suggesting no widely deployed exploits yet. Nevertheless, the attack vector is remote via a maliciously crafted HTML page viewed in the browser, so any user who visits an untrusted site or opens a malicious file could be at risk. Successful exploitation would require the victim to load the malicious content; no local privilege escalation is required.