The vulnerability is a CWE‑787 out‑of‑bounds write that occurs within the Media component of Google Chrome on desktop platforms. A maliciously crafted HTML document can trigger the defect when processed by a renderer that has been compromised by an attacker. This defect can lead the compromised renderer to escape the browser sandbox, allowing the attacker to execute arbitrary code with the privileges of the user that launched Chrome.

Google Chrome versions before 148.0.7778.168 on Windows, macOS, and Linux are affected. Users running Chrome 147 or older, or any 148 release earlier than build 148.0.7778.168, are at risk until they upgrade to the patched version.

Chromium labels the issue as high severity, reflected in a CVSS score of 8.3, but no EPSS score is available. The vulnerability is not listed in the CISA KEV catalog, indicating that no publicly available exploits are known at this time. Exploitation would require an attacker to first compromise or coerce the renderer process, commonly through malicious web content; once that is achieved, the out‑of‑bounds write could lead to a sandbox escape. The risk is therefore high if users run susceptible versions and visit untrusted websites, but lower if the renderer remains uncompromised. Immediate patching mitigates the threat.