A heap buffer overflow exists in the WebCodecs component of Google Chrome prior to 148.0.7778.216. The flaw permits a remote attacker, through a specially crafted HTML page, to execute arbitrary code inside the browser sandbox. This is a traditional buffer overflow (CWE‑120 and CWE‑122). The impact is high, as direct code execution can allow an attacker to gain full control over the sandboxed browser process, potentially leading to further attacks if sandbox escape is achieved.

Affected products are Google Chrome, specifically all releases before version 148.0.7778.216. Users on the Stable channel who have not applied the latest patch are at risk.

The flaw can be triggered simply by a victim viewing a malicious web page that contains crafted media. Chromium assigns a high severity, with a CVSS score of 8.8. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the attack vector is remote and the impact is complete arbitrary code execution within the browser sandbox, the overall risk remains significant for unpatched users, although the low EPSS suggests current exploit activity is limited.