An input validation flaw in the Media subsystem of Google Chrome on macOS allows a crafted HTML page to execute arbitrary code outside the browser’s sandbox, giving an attacker full control over the affected system. This vulnerability is non-browser-only; it can be triggered simply by loading a maliciously crafted page over a network, leading to possible data theft, persistence, or lateral movement. The flaw stems from improper handling of media input data, as indicated by CWE-20, and is rated high severity by Chromium engineers.

Google Chrome for macOS versions earlier than 151.0.7922.169 are affected. All users running those versions on macOS are vulnerable. The bug was reported to Chromium and will be fixed in the stated patch.

The CVSS score is not available, but Chromium classifies it as High, and it is not listed in the CISA KEV catalog. The EPSS score is not available, so current exploit likelihood is unknown, but the nature of the flaw—remote code execution via a web page—suggests that an attacker with network access could exploit it by serving a malicious page. No prerequisites beyond browsing to a crafted URL are needed, making the risk particularly acute for users who visit untrusted sites.