This vulnerability arises from improper handling in the PlatformIntegration module of Google Chrome on Windows versions before 149.0.7827.53. A remote attacker can exploit this by convincing a user to perform certain UI gestures involving a malicious file, leading to arbitrary code execution. The CVSS vector indicates the attack requires network access, high attack complexity, no privileges, user interaction, and results in high confidentiality and integrity impact without affecting availability. There is no explicit vendor remediation level stated, but the affected versions are prior to 149.0.7827.53.

Successful exploitation allows remote attackers to execute arbitrary code on the affected system, compromising confidentiality and integrity. The attack requires user interaction and has high complexity, limiting ease of exploitation. There are no known exploits in the wild at this time.

A fix is available in Google Chrome version 149.0.7827.53. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for update instructions and confirmation.