This vulnerability arises from improper validation of untrusted input within the codecs component of Google Chrome versions before 149.0.7827.53. An attacker who has compromised the renderer process could exploit this flaw to perform a sandbox escape, which would allow execution of code outside the restricted environment. The issue is classified under CWE-20 (Improper Input Validation) and has a CVSS v3.1 score of 9.6, indicating critical impact with network attack vector, low attack complexity, no privileges required, user interaction required, and complete confidentiality, integrity, and availability impact. The vendor has published an advisory but has not explicitly stated the remediation level or patch availability in the provided data.

Successful exploitation could lead to a sandbox escape from the renderer process, potentially allowing an attacker to execute arbitrary code with higher privileges than normally permitted within the browser sandbox. This elevates the risk of system compromise, data theft, or further malicious activity. The CVSS score of 9.6 reflects critical severity with full impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted content and consider applying any available updates promptly once released.