This vulnerability involves a use-after-free condition (CWE-416) in the Video processing component of Google Chrome before version 147.0.7727.101. Exploitation requires a user to visit a specially crafted HTML page, enabling remote code execution inside the sandbox environment. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects network attack vector, low attack complexity, no privileges required, user interaction needed, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on April 15, 2026, and Google has released a stable update to fix it.

Successful exploitation could allow a remote attacker to execute arbitrary code within the sandboxed environment of the Chrome browser, potentially compromising confidentiality, integrity, and availability of the affected system. However, no active exploits have been reported in the wild so far.

Google has released an official stable channel update (version 147.0.7727.101) that addresses this vulnerability. Users and administrators should apply this update promptly to remediate the issue. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html.