An object lifecycle issue in the Metrics component of Google Chrome before version 149.0.7827.155 allows a remote attacker with control over the renderer process to potentially perform a sandbox escape by delivering a crafted HTML page. The vulnerability is rated high severity with a CVSS score of 8.3, indicating network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed with high impact on confidentiality, integrity, and availability. The vulnerability was publicly disclosed on June 17, 2026. No known exploits in the wild have been reported. The vendor advisory is available but does not explicitly state the patch or remediation status.

Successful exploitation could allow an attacker who has compromised the renderer process to escape the sandbox, potentially leading to full system compromise. This affects the confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and has a high attack complexity, which may limit exploitation scenarios.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_01750511403.html for current remediation guidance. Until an official fix is confirmed, users should apply the latest Chrome updates as they become available. No specific temporary mitigations are provided in the available data.