This vulnerability involves a type confusion error in the ANGLE graphics abstraction layer within Google Chrome versions before 149.0.7827.53. Exploiting this flaw can lead to out-of-bounds writes in memory, resulting in heap corruption. The issue can be triggered remotely via a specially crafted HTML page, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory linked confirms a stable channel update that fixes this vulnerability.

Successful exploitation can lead to heap corruption, which may allow an attacker to execute arbitrary code, compromise user data confidentiality and integrity, or cause denial of service. The vulnerability is remotely exploitable without privileges but requires user interaction (visiting a malicious page). No known active exploits have been reported.

Google has released an official stable channel update for Chrome that addresses this vulnerability. Users and administrators should update to version 149.0.7827.53 or later to remediate the issue. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No additional mitigations are indicated by the vendor.