This vulnerability involves a heap buffer overflow in the Media subsystem of Google Chrome before version 149.0.7827.53. Exploitation requires user interaction through specific UI gestures on a maliciously crafted HTML page, enabling remote code execution inside the sandbox environment. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue is publicly disclosed and patched in the stable channel update referenced by Google.

Successful exploitation can lead to arbitrary code execution within the sandboxed environment of Chrome, potentially compromising confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and specific UI gestures, which may limit attack feasibility. No known active exploits have been reported.

Google has released an official stable channel update that addresses this vulnerability. Users and administrators should update Google Chrome to version 149.0.7827.53 or later to remediate this issue. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html. No additional mitigation steps are indicated by the vendor.