This vulnerability (CVE-2026-10904) affects the V8 JavaScript engine in Google Chrome versions before 149.0.7827.53. Due to an inappropriate implementation, a remote attacker can execute arbitrary code inside the sandbox environment by crafting a malicious HTML page. The issue is classified under CWE-94 (Improper Control of Generation of Code), CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer), and CWE-20 (Improper Input Validation). The CVSS 3.1 base score is 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at the time of publication. The vendor advisory URL points to a Chrome stable channel update announcement but does not explicitly confirm patch availability or remediation status.

Successful exploitation allows remote attackers to execute arbitrary code within the sandbox of Google Chrome, potentially compromising confidentiality, integrity, and availability of the affected system. This can lead to unauthorized code execution despite sandbox protections.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply official fixes once available. Until then, exercise caution when browsing untrusted websites and avoid interacting with suspicious HTML content.