This vulnerability involves type confusion in the Media component of Google Chrome before version 149.0.7827.53. Type confusion can lead to memory corruption, enabling remote code execution inside the sandbox when a user interacts with a maliciously crafted HTML page. The CVSS 3.1 vector indicates the attack requires no privileges, has low complexity, requires user interaction, and impacts confidentiality, integrity, and availability at a high level. The vulnerability was publicly disclosed on June 4, 2026. The vendor advisory link is provided but does not explicitly confirm patch availability or remediation level in the input data.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the browser's security boundaries. This can lead to full compromise of the browser process, affecting confidentiality, integrity, and availability of user data and browser functionality. No known exploits in the wild have been reported at the time of disclosure.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed and applied, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious content. No vendor advisory content explicitly states that no action is required or that the issue is already mitigated.