This vulnerability in Google Chrome arises from insufficient validation of untrusted input in the USB component, allowing remote code execution via a crafted HTML page. It affects versions before 148.0.7778.216. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects that an attacker can exploit this remotely over the network with low attack complexity and no privileges, requiring user interaction, resulting in high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details. No known exploits have been reported in the wild.

Successful exploitation allows remote attackers to execute arbitrary code on the victim's system, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction but no privileges or complex attack conditions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution when interacting with untrusted web content, especially involving USB device interactions. No specific mitigations are provided by the vendor advisory at this time.