An integer overflow occurs within Chrome's media handling components in any build prior to version 147.0.7727.55. When a specially crafted video file is parsed, the overflow can corrupt the heap and potentially allow an attacker to execute arbitrary code in the context of the browser process. The vulnerability is considered to enable remote code execution, though the severity scored low in Chromium's internal review.

Google Chrome browsers running any release version earlier than 147.0.7727.55 are affected. This includes all desktop and mobile builds of Chrome before that release. No other vendors or product lines are impacted.

No EPSS score is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting it is not currently known to be widely exploited. The likely attack vector is remote – an attacker can serve a malicious video file to a user who opens or streams it in Chrome. While the severity is low, heap corruption offers a pathway to leverage additional exploits or pivot into the operating system if successful.