This vulnerability involves a use-after-free condition in the media handling code of Google Chrome before version 147.0.7727.138. Exploitation requires a remote attacker to deliver a crafted HTML page that triggers arbitrary code execution inside the browser's sandbox environment. The issue was publicly disclosed on April 28, 2026, and is rated as high severity by Chromium security. No CVSS score is provided. The vendor advisory is linked but does not explicitly state patch or remediation status in the provided data.

Successful exploitation could allow remote attackers to execute arbitrary code within the sandbox of the affected Chrome browser, potentially leading to unauthorized actions or compromise of the browser environment. However, there are no reports of active exploitation in the wild.

Check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for the latest remediation information. Since the vulnerability affects Chrome versions prior to 147.0.7727.138, updating to version 147.0.7727.138 or later is likely the intended fix. Patch status is not explicitly confirmed in the provided data, so users should verify the update status directly from the vendor advisory.