This vulnerability involves a use-after-free condition (CWE-416) in the Device Trust feature of Google Chrome on Mac platforms before version 149.0.7827.53. Exploitation requires that the attacker already control the renderer process, after which they may execute a sandbox escape via a specially crafted HTML page. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details, so patch status remains unconfirmed.

Successful exploitation could lead to a sandbox escape, allowing an attacker to break out of the renderer process restrictions and potentially execute arbitrary code with higher privileges. This compromises the browser's security model, risking confidentiality, integrity, and availability of the affected system. Given the critical CVSS score (9.6), the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Until official fixes are confirmed and applied, users should exercise caution when browsing untrusted content and consider limiting exposure to potentially malicious HTML pages. No vendor advisory states that no action is required or that the issue is already mitigated.