CVE-2026-10966 is a critical vulnerability in Google Chrome's Codecs implementation affecting versions before 149.0.7827.53. The issue stems from improper validation of untrusted input, which could enable a remote attacker to escape the browser sandbox via a crafted video file. This vulnerability is classified under CWE-20 (Improper Input Validation) and carries a CVSS v3.1 score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and complete impact on confidentiality, integrity, and availability. The vendor advisory is linked but does not explicitly state patch availability or remediation status in the provided data.

Successful exploitation could allow a remote attacker to escape the sandbox environment of Google Chrome, potentially leading to full system compromise. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when handling untrusted video files and consider applying any available updates promptly once released by Google.