Executive brief
Google Chrome is a widely used web browser. A security vulnerability in the way the browser handles media codecs could allow a remote attacker to bypass security protections (the 'sandbox') that normally isolate the browser from the rest of the computer. If successfully exploited via a malicious website, this could allow an attacker to gain broader access to the underlying Windows operating system.
Technical details
An improper input validation vulnerability (CWE-20) exists in the Codecs component of Google Chrome for Windows. The flaw allows a remote attacker who has already achieved code execution within the renderer process to escape the Chrome sandbox. This is achieved by providing specially crafted input that the Codecs component fails to validate correctly. The vulnerability is addressed in version 150.0.7871.115. Exploitation requires the attacker to lure a user to a malicious HTML page and first compromise the renderer process.
Affected products
- Google Chrome prior to 150.0.7871.115
Timeline
- 2026-06-14: disclosed: Reported to Chromium project
- 2026-07-08: patched: Fixed in version 150.0.7871.115
- 2026-07-08: advisory