An out of bounds read vulnerability exists in the Headless component of Google Chrome versions prior to 148.0.7778.216. This vulnerability allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. The issue is tracked as CVE-2026-10017 with a CVSS v3.1 score of 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting high impact on confidentiality, integrity, and availability. The vulnerability is classified as high severity by Chromium security. The vendor advisory linked does not explicitly state patch availability or remediation level, so users should consult the official Chrome release notes for the latest status.

Successful exploitation could allow a remote attacker with access to the renderer process to escape the Chrome sandbox, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. The CVSS score of 8.3 indicates a high impact. No known exploits in the wild have been reported, which may reduce immediate risk but does not eliminate the threat.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users should ensure they update to Chrome version 148.0.7778.216 or later once confirmed patched. Until then, exercising caution with untrusted HTML content and limiting renderer process exposure may reduce risk.