The vulnerability is a race condition in the graphics processing unit handling within Google Chrome on Windows. A crafted video file can trigger the race, allowing a remote attacker to escape the browser sandbox and potentially execute arbitrary code at the host system level. The weakness is classified as CWE‑362 and CWE‑368 and can compromise confidentiality, integrity, and availability by granting the attacker unrestricted access to the operating system.

Google Chrome on Windows, versions prior to 147.0.7727.117. The issue is limited to the Windows build of Chrome; no affected versions are listed for Android or Linux kernels in the current advisory.

The CVSS score of 8.3 indicates high severity, yet the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not listed in CISA KEV. Exploitation would likely involve an attacker delivering a malicious video file to a user’s browser, a method that requires user interaction but can be piggybacked on phishing or drive‑by situations. Given the low EPSS, the risk remains moderate under current conditions, but the potential impact warrants timely action.