This vulnerability involves a use-after-free condition in the WebRTC implementation of Google Chrome before version 149.0.7827.53. Exploiting this flaw enables remote code execution inside the sandboxed environment by delivering a specially crafted HTML page to the victim. The CVSS 3.1 vector indicates the attack requires no privileges and user interaction, with network attack vector and high impact on confidentiality, integrity, and availability. The issue is publicly disclosed and fixed in the specified Chrome version.

Successful exploitation can lead to arbitrary code execution within the sandboxed process of Chrome, potentially compromising user data and system integrity. The vulnerability affects confidentiality, integrity, and availability at a high level. There are currently no reports of active exploitation in the wild.

Users and administrators should update Google Chrome to version 149.0.7827.53 or later, where this vulnerability is fixed. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html confirms the availability of this update. No additional mitigation steps are indicated by the vendor.