This vulnerability involves a use-after-free condition in the codecs implementation of Google Chrome before version 147.0.7727.101. An attacker can exploit this by delivering a crafted video file that triggers out-of-bounds memory access, potentially leading to memory corruption. The issue is tracked as CWE-416. The CVSS vector indicates the attack requires network access, low attack complexity, no privileges, and user interaction, with limited confidentiality impact and no integrity or availability impact.

Successful exploitation could allow an attacker to cause out-of-bounds memory access, which may lead to memory corruption or application instability. The impact is limited to confidentiality with no direct integrity or availability effects reported. No known active exploits have been observed.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_15.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official fixes once available. Until then, exercising caution with untrusted video files is advisable.