This vulnerability involves an integer overflow in the Skia component of Google Chrome before version 149.0.7827.53. The overflow can lead to heap corruption, potentially allowing a remote attacker to execute arbitrary code or cause denial of service by crafting a malicious HTML page. The CVSS 3.1 vector indicates the attack requires no privileges and user interaction, with high impact on confidentiality, integrity, and availability. The vulnerability is tracked as CWE-122 (Heap-based Buffer Overflow).

Successful exploitation could allow a remote attacker to cause heap corruption, leading to arbitrary code execution or browser crash. The vulnerability impacts confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Since the affected version is prior to 149.0.7827.53, updating to version 149.0.7827.53 or later is recommended once confirmed by the vendor. No temporary mitigations are specified.