This vulnerability involves a use-after-free condition in the Autofill feature of Google Chrome on Android before version 149.0.7827.53. Exploitation requires that an attacker has compromised the renderer process and can deliver a crafted HTML page to trigger a sandbox escape. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to escape the Chrome sandbox on Android, potentially leading to full compromise of the affected device. The impact includes complete loss of confidentiality, integrity, and availability of the system due to sandbox escape.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until a patch is confirmed and applied, users should exercise caution with untrusted web content and avoid interacting with suspicious sites. No official fix or temporary workaround is explicitly stated in the provided data.