This vulnerability arises from an inappropriate implementation in the Isolated Web Apps feature of Google Chrome before version 149.0.7827.53. It permits remote code execution within the sandbox environment via a crafted malicious file. The issue was publicly disclosed with medium severity by Chromium security. The vendor advisory is available but does not specify whether an official fix has been released or if a temporary mitigation exists.

Successful exploitation could allow a remote attacker to execute arbitrary code inside the sandboxed environment of Chrome's Isolated Web Apps. This could potentially compromise the security boundary intended by the sandbox, but the impact is limited to the sandbox context. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when handling untrusted files within Isolated Web Apps. No vendor advisory states that no action is required or that the issue is already mitigated.