This vulnerability arises from insufficient validation of untrusted input within the Skia graphics library used by Google Chrome on Android. An attacker who has compromised the renderer process could leverage this flaw to perform a sandbox escape by delivering a specially crafted HTML page. The issue affects Chrome versions prior to 148.0.7778.216. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker with control over the renderer process to escape the sandbox environment, potentially leading to full compromise of the affected device. This includes unauthorized access to sensitive data, modification of system components, and disruption of availability. However, exploitation requires prior compromise of the renderer process and user interaction.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content on affected Chrome versions. No explicit vendor advisory states that no action is required or that the issue is already mitigated.