An out‑of‑bounds write in the Codecs component of Google Chrome on macOS versions prior to 148.0.7778.168 can be triggered by a specially crafted video file. The flaw allows a remote attacker to escape the browser sandbox, potentially enabling the execution of arbitrary code on the host system. The weakness is classified as CWE‑787.

The vulnerability affects Google Chrome running on macOS devices. Versions before 148.0.7778.168 are vulnerable; later releases contain the fix.

No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.3, indicating high severity. The medium Chromium severity rating suggests that while the flaw is serious, attackers would need to supply a crafted video to the target. The risk is contingent on user interaction with malicious media, but a sandbox escape permits full compromise of the host. The lack of public exploit data implies the threat may still be low to moderate but the potential impact warrants prompt remediation.