This vulnerability is a race condition in the V8 engine of Google Chrome versions before 147.0.7727.55. Exploiting this flaw could lead to heap corruption when processing a specially crafted HTML page. The CVSS 3.1 base score is 6.8, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, and user interaction needed. The impact includes high confidentiality and integrity loss but no availability impact. The vulnerability was publicly disclosed on April 8, 2026, and a Google advisory is linked but does not explicitly confirm patch availability or remediation level.

Successful exploitation could result in heap corruption, potentially allowing an attacker to compromise the confidentiality and integrity of the affected system. The attack requires user interaction and has a high complexity, which reduces the likelihood of widespread exploitation. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until confirmation of a fix, users should exercise caution when interacting with untrusted web content. No specific temporary mitigations are provided by the vendor advisory.