Executive brief
A vulnerability in Google Chrome's video processing components could allow a malicious website to bypass the browser's security sandbox. By tricking a user into opening a specially crafted video file, an attacker could potentially gain unauthorized access to the underlying operating system. This could lead to the theft of sensitive data or the installation of malicious software beyond the browser's normal restricted environment.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Codecs component of Google Chrome. The flaw stems from insufficient validation of untrusted data when processing video files. A remote attacker can exploit this by hosting a specially crafted video file on a website; if a user views the file, the attacker could potentially achieve a sandbox escape. This allows code execution to break out of the browser's isolated process and interact with the host operating system. The issue is resolved in Google Chrome version 149.0.7827.53 and later.
Affected products
- Google Chrome prior to 149.0.7827.53
Timeline
- 2026-06-02: patched: Chrome 149.0.7827.53 released to stable channel.
- 2026-06-04: disclosed: CVE published in NVD.