This vulnerability arises from insufficient validation of untrusted input within the Metrics component of Google Chrome before version 149.0.7827.155. An attacker with control over the renderer process can exploit this object lifecycle issue to potentially perform a sandbox escape, which could lead to elevated privileges or further compromise of the host system. The vulnerability is acknowledged by Google with a high severity rating. The vendor advisory linked indicates a stable channel update addressing this issue.

Successful exploitation could allow an attacker who has already compromised the renderer process to escape the Chrome sandbox, potentially leading to execution of code outside the sandbox restrictions. This increases the risk of system-level compromise beyond the browser sandbox. There are no known exploits in the wild at the time of disclosure.

A fix is available in Google Chrome version 149.0.7827.155. Users and administrators should update to this version or later to mitigate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for detailed update instructions.