This vulnerability in Google Chrome's HID implementation prior to version 150.0.7871.47 is caused by insufficient policy enforcement, which can be exploited by a remote attacker via a crafted HTML page to execute arbitrary code on the victim's system. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly known and documented under CVE-2026-14086. Although no known exploits in the wild have been reported, the risk is significant due to the potential for remote code execution.

Successful exploitation allows remote code execution with high impact on confidentiality, integrity, and availability of the affected system. An attacker can run arbitrary code by convincing a user to visit a maliciously crafted HTML page, potentially leading to full system compromise.

Google has released Chrome version 150.0.7871.47 to address this vulnerability. Users and administrators should update to this version or later to mitigate the risk. Patch status is not explicitly stated in the vendor advisory linked, but the presence of the fixed version indicates an official fix is available. No additional mitigation steps are specified by the vendor.