An integer overflow in Chrome’s codec implementation on Windows, present in versions prior to 148.0.7778.168, can be triggered by a crafted video file. When exploited, the overflow potentially allows a sandbox escape, giving an attacker the possibility to execute code outside the browser’s security boundaries. The vulnerability is rated Medium by Chromium’s severity scale, indicating a significant impact but not an immediately critical flaw.

Google Chrome for Windows users running any version earlier than 148.0.7778.168 are affected. The issue does not impact other operating systems or browsers, only the Chrome Windows build uses the vulnerable codec logic.

Because the vulnerability requires an attacker to supply a malicious video file that the user or a web page feeds into Chrome, the attack vector is remote via web content or a file download. The EPSS score is not available, and the flaw is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The CVSS score of 8.3 labels this flaw as high severity, and the potential for sandbox escape means that an exploit could provide the attacker with process privileges on the victim’s machine. The risk is moderate to high for users who regularly view untrusted video content, so applying the fix promptly is advisable.