This vulnerability involves a use-after-free condition in the Actor component of Google Chrome before version 149.0.7827.53. Exploiting this flaw enables remote code execution inside the browser's sandbox environment through a specially crafted HTML page. The CVSS 3.1 base score is 8.8, reflecting high impact on confidentiality, integrity, and availability. The issue is publicly disclosed and fixed in the Chrome stable update referenced in the vendor advisory.

Successful exploitation allows a remote attacker to execute arbitrary code inside the sandboxed environment of the Chrome browser, potentially compromising user data and system integrity. The high CVSS score indicates significant risk if exploited. No active exploits have been reported so far.

A fixed version of Google Chrome (149.0.7827.53 or later) is available that addresses this vulnerability. Users and administrators should update to this version promptly. The vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html provides official update details. No additional mitigations are specified by the vendor.