This vulnerability is an example of insufficient input validation of untrusted media content in Google Chrome for Android. If an attacker can place specially crafted media within an HTML page and already compromises the renderer process, the browser can escape the sandbox and potentially execute code with elevated privileges. The weakness is classified as CWE-20, "Improper Input Validation," and the Chromium team assessed it with a high severity. This gives an attacker the ability to elevate privileges and potentially compromise the entire device if the sandbox is bypassed.

Google Chrome installed on Android devices with versions older than 148.0.7778.96. Any Android device running the affected Chrome builds is vulnerable, while newer Chrome releases are not affected.

No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The CVE description states that a remote attacker who has already compromised the renderer process could escape the sandbox, with a CVSS score of 8.3 indicating high severity, implying that additional steps such as obtaining initial local code execution or a prior compromise are required to reach the flaw. Because the vendor has classified the issue as high severity and no exploit is known in the wild, the risk is considered moderate to high for environments that still run legacy Chrome versions.