This vulnerability involves an out-of-bounds read in the DevTools feature of Google Chrome versions prior to 149.0.7827.53. Exploitation requires user interaction (UI required) and allows remote attackers to execute arbitrary code inside a sandbox via a specially crafted HTML page. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a high severity score but no explicit remediation level or patch link is provided in the input data. The vendor advisory URL points to a Chrome stable channel update blog, which should be checked for patch status.

Successful exploitation can lead to arbitrary code execution within the sandboxed environment of Chrome DevTools, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the significant impact if exploited. However, no known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop.html for current remediation guidance. Users should update Google Chrome to version 149.0.7827.53 or later once available to mitigate this vulnerability. Until then, exercise caution when interacting with untrusted web content, especially involving DevTools.