This vulnerability involves script injection in the Headless mode of Google Chrome versions before 149.0.7827.53. An attacker can exploit this by crafting a malicious HTML page that, when processed by the vulnerable browser, enables arbitrary code execution. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability at a high level. The issue is classified as high severity by Chromium security.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, potentially leading to full compromise of the browser environment and any data accessible through it. The vulnerability affects confidentiality, integrity, and availability of the system running the vulnerable Chrome version.

The vendor has published a stable channel update advisory for Chrome, which likely includes a fix for this vulnerability. However, the explicit patch or remediation status is not confirmed in the provided data. Users should update to Chrome version 149.0.7827.53 or later as soon as possible. Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance.