Executive brief
A vulnerability in Google Chrome's media processing components could allow a malicious website to bypass security restrictions. If a user visits a specially crafted webpage, an attacker who has already gained limited control over the browser's rendering process could escape the 'sandbox'—a security layer designed to isolate the browser from the rest of the computer. This could potentially allow the attacker to access sensitive data or execute unauthorized commands on the underlying operating system.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Codecs component of Google Chrome. The flaw allows a remote attacker to bypass sandbox isolation. To exploit this, an attacker must first compromise the renderer process (typically via a separate vulnerability) and then provide specially crafted input to the Codecs component via a malicious HTML page. Successful exploitation enables a sandbox escape, allowing the attacker to interact with the host operating system. The issue is resolved in Chrome version 149.0.7827.53.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel
- 2026-06-04: disclosed: CVE-2026-11095 published