This vulnerability involves a use-after-free condition in the Web Authentication feature of Google Chrome. Exploitation requires user interaction (UI:R) and can be triggered remotely via a malicious HTML page, potentially leading to arbitrary code execution. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The affected versions are all Chrome versions prior to 149.0.7827.155.

Successful exploitation could allow a remote attacker to execute arbitrary code on the victim's system, compromising confidentiality, integrity, and availability of the affected system. This could lead to full system compromise depending on the privileges of the Chrome process.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for current remediation guidance. Users and administrators should apply the official update to Chrome version 149.0.7827.155 or later once available to mitigate this vulnerability.