This vulnerability involves a heap buffer overflow in the TabStrip feature of Google Chrome before version 149.0.7827.53. Exploitation requires user interaction through specific UI gestures on a maliciously crafted HTML page, which may cause heap corruption. The CVSS 3.1 vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. The vendor advisory link is available but does not specify if an official fix has been released yet.

Successful exploitation can result in heap corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability affects confidentiality, integrity, and availability of the affected system. No active exploitation has been reported to date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should avoid interacting with untrusted web content that could trigger the specific UI gestures involved.