Description

Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-25T21:18:09.160Z",
  "pubdate": "2026-08-25T21:18:09.160Z",
  "executiveSummary": "This vulnerability involves an improper input validation flaw within the Media component of Google Chrome on Windows.\nThe vulnerability allows a remote attacker who has already achieved code execution within the compromised renderer process to escape the sandbox environment.\nBy leveraging a specially crafted HTML page, the attacker can execute arbitrary code on the underlying host operating system.\nThe flaw affects Google Chrome versions prior to 152.0.7977.65.\nThe Chromium project has classified the security severity of this vulnerability as Medium.\nThis represents a significant security risk, as sandbox escapes are critical primitives for full system compromise, though the requirement for a prior renderer compromise limits the immediate attack surface to scenarios where the renderer is already under attacker control.",
  "technicalDetails": "The vulnerability resides in the Media component of the Chromium browser engine, specifically originating from a failure to correctly sanitize or validate input data provided during media processing routines.\nThe root cause is an improper input validation flaw that occurs when the renderer process handles crafted media elements provided via an HTML page. While the renderer process is traditionally constrained by Chrome's sandbox, this flaw provides a vector for an attacker who has already gained control of the renderer to move laterally and compromise the host.\nThe attack flow begins when a user is directed to a malicious HTML page hosting a crafted media payload. Upon interaction, the renderer process attempts to parse the malicious input. Due to the validation flaw, the interaction triggers a memory-related condition or logical error within the Media subsystem, which the attacker exploits to break out of the renderer sandbox.\nSuccessful exploitation allows for arbitrary code execution on the host machine, bypassing the security isolation mechanisms intended to restrict the renderer's access to the filesystem, system processes, and network resources.\nThe vulnerability is restricted to Windows environments, suggesting that the underlying flaw may involve platform-specific media APIs or the way the Media component interacts with Windows-specific system libraries.\nSince the exploit requires a compromised renderer, it functions as a secondary-stage vulnerability in an attack chain. The attacker must first gain initial code execution in the renderer (e.g., via a separate memory corruption vulnerability) before this sandbox escape can be utilized to gain further system-level control.\nThe scope of post-exploitation activity is extensive, enabling the attacker to run commands with the privileges of the Chrome process, potentially leading to persistent system installation, data exfiltration, or further privilege escalation depending on the environment configuration.\nThe affected versions include all Google Chrome releases on Windows prior to 152.0.7977.65."
}