A memory corruption flaw exists in Chrome’s MediaStream handling that allows an attacker to craft an HTML page and trigger the bug, potentially reading memory inside the browser’s sandbox. This gives the attacker access to confidential data stored in the sandbox and could be a stepping‑stone toward escaping the sandbox. The weakness is an example of a buffer overrun (CWE‑119).

The vulnerability affects Google Chrome before version 156.0.8078.79. No specific sub‑products are listed beyond the core Chrome browser.

The flaw is classified as Critical by Chromium. No EPSS score is available, and the vulnerability is not in CISA’s KEV catalog. Attackers would need to lure a user to a malicious web page that includes the vulnerable MediaStream code. Because the flaw exists inside a sandboxed process, exploitation could lead to a sandbox escape if additional vulnerabilities exist. The lack of an official workaround means only an official update mitigates the risk.