This vulnerability in Google Chrome's Media component on Windows arises from insufficient validation of untrusted input. An attacker who has already compromised the renderer process could exploit this flaw by delivering a specially crafted HTML page to perform a sandbox escape. The sandbox escape could lead to elevated privileges or further compromise of the host system. The issue affects Chrome versions prior to 149.0.7827.53. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows a remote attacker with control over the renderer process to escape the sandbox, potentially leading to full system compromise or elevated privileges on the affected Windows system running vulnerable Chrome versions. This impacts the confidentiality, integrity, and availability of the system.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides official update guidance. No additional mitigations are specified by the vendor.