This vulnerability involves a use-after-free condition in the Skia graphics library used by Google Chrome on Android. Exploitation requires user interaction (UI required) and can lead to remote code execution inside the sandbox. The affected versions are all versions prior to 150.0.7871.47. The CVSS vector indicates the attack can be performed remotely over the network with low attack complexity and no privileges required. The impact includes high confidentiality, integrity, and availability consequences. Although a vendor advisory link is provided, it does not explicitly state the availability of a patch or fix.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Chrome on Android, potentially compromising confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions or data exposure within the browser context.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when browsing untrusted websites and avoid interacting with suspicious HTML content.