An out-of-bounds read vulnerability exists in the Media component of Google Chrome before version 147.0.7727.101. Exploitation requires user interaction involving specific UI gestures on a malicious HTML page, potentially leading to arbitrary code execution. The vulnerability is classified as CWE-125 and carries a CVSS 3.1 base score of 7.5, indicating high severity. No explicit remediation level or patch availability is stated in the provided vendor advisory link, though the affected version suggests the issue is addressed in or after 147.0.7727.101.

Successful exploitation can result in arbitrary code execution with no privileges required but user interaction necessary. The vulnerability affects confidentiality, integrity, and availability of the affected system. There are no known active exploits reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Users should update to version 147.0.7727.101 or later if available, as the vulnerability affects versions prior to this. Until confirmation of patch availability, avoid interacting with untrusted or suspicious web content that may trigger the vulnerability.