An out-of-bounds write vulnerability exists in the GPU implementation of Google Chrome versions before 149.0.7827.53. This vulnerability could be exploited remotely via a specially crafted HTML page to perform a sandbox escape, potentially allowing an attacker to execute arbitrary code outside the browser's restricted environment. The issue is tracked as CVE-2026-10897 and is rated critical by Chromium security. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory linked does not explicitly state patch availability or remediation details.

Successful exploitation of this vulnerability could allow a remote attacker to escape the Chrome sandbox, potentially leading to arbitrary code execution with the privileges of the user running the browser. This compromises the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the severity of the impact. No known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious HTML content. Monitor the vendor advisory for updates on patches or mitigations.