An out-of-bounds write vulnerability exists in the codecs processing of Google Chrome on Mac platforms before version 148.0.7778.168. This vulnerability could be triggered remotely by a crafted video file, potentially enabling sandbox escape. The issue was publicly disclosed on May 14, 2026, with a medium severity rating by Chromium security. Although no CVSS score or explicit remediation level is provided, the vendor advisory references a stable channel update that presumably includes a fix for this vulnerability.

A remote attacker could exploit this out-of-bounds write vulnerability by delivering a maliciously crafted video file to a vulnerable Chrome browser on Mac. Successful exploitation may allow the attacker to escape the browser sandbox, potentially leading to further compromise of the host system. No known active exploits have been reported, and the impact is rated medium severity by the vendor.

Google has released a stable channel update for Chrome that includes version 148.0.7778.168 or later, which addresses this vulnerability. Users should update their Chrome browsers on Mac to version 148.0.7778.168 or later to remediate this issue. Patch status is not explicitly confirmed in the advisory text provided, so users should verify the update details in the official Google Chrome release notes linked in the vendor advisory.