This vulnerability involves a use-after-free condition in the Passwords feature of Google Chrome on Mac platforms before version 149.0.7827.53. Exploitation requires user interaction through specific UI gestures triggered by a maliciously crafted HTML page, enabling remote code execution. The CVSS score of 7.5 reflects a high impact on confidentiality, integrity, and availability, with attack complexity rated as high and requiring user interaction.

Successful exploitation could allow an attacker to execute arbitrary code remotely on the affected system, potentially leading to full compromise of the user's environment. The vulnerability affects confidentiality, integrity, and availability of the system. There are no reports of active exploitation in the wild.

The vendor has released a stable channel update for desktop Chrome as referenced in the advisory (https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html). Although the explicit patch status is not stated in the provided data, the presence of a stable update strongly indicates that a fix is available. Users should update Google Chrome on Mac to version 149.0.7827.53 or later to remediate this vulnerability. Until updated, users should exercise caution with untrusted web content that may prompt UI interactions.