This vulnerability is a use-after-free (CWE-416) in the Media component of Google Chrome before version 147.0.7727.55. It enables remote code execution inside the sandbox via a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on April 8, 2026. The vendor advisory URL points to a Chrome stable channel update, implying that updating Chrome to version 147.0.7727.55 or later mitigates the vulnerability.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the critical nature of this vulnerability. However, no known exploits in the wild have been reported so far.

Users should update Google Chrome to version 147.0.7727.55 or later, as indicated by the affected version and the vendor's stable channel update advisory. Since this is a client-side vulnerability, applying the official update is the primary mitigation. Patch status is not explicitly confirmed in the advisory, but the presence of the fixed version strongly suggests that updating resolves the issue. Monitor the vendor advisory for any additional guidance.