This vulnerability arises from improper validation of untrusted input within the codecs component of Google Chrome before version 149.0.7827.53. An attacker can exploit this by delivering a specially crafted video file that triggers an out-of-bounds memory write, potentially leading to arbitrary code execution or other severe impacts. The CVSS v3.1 base score is 8.8, indicating a high level of severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-20 (Improper Input Validation).

Successful exploitation allows a remote attacker to perform an out-of-bounds memory write, which can result in arbitrary code execution, complete compromise of the affected system's confidentiality, integrity, and availability. This can be triggered by a user opening or processing a crafted video file in the vulnerable version of Chrome.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor advisory linked (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html) should be monitored for updates on official fixes. Until a patch is confirmed, users should exercise caution when handling untrusted video files and consider updating to the latest Chrome version once available.