This vulnerability involves a use-after-free condition in the WebMIDI implementation of Google Chrome on Android devices before version 148.0.7778.216. Exploitation requires that the attacker already has control over the renderer process and can deliver a specially crafted HTML page to trigger a sandbox escape. The vulnerability is rated high severity with a CVSS 3.1 score of 8.3, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction. The vendor advisory is available but does not explicitly state remediation details.

Successful exploitation could allow an attacker with renderer process access to escape the Chrome sandbox, potentially leading to greater system compromise on affected Android devices. The impact includes full confidentiality, integrity, and availability compromise of the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users should update Chrome on Android to version 148.0.7778.216 or later once available. Until then, avoid interacting with untrusted web content that could trigger this vulnerability.