This vulnerability involves a use-after-free condition in the WebRTC implementation of Google Chrome before version 147.0.7727.138. Exploitation requires user interaction (visiting a malicious HTML page) and could lead to remote code execution inside the sandboxed environment of the browser. The CVSS vector indicates the attack is network-based, requires low attack complexity, no privileges, but user interaction, and impacts confidentiality, integrity, and availability at a high level. The issue is publicly documented with a vendor advisory announcing the stable channel update that includes the fix.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely within the sandboxed context of the Chrome browser. This could lead to compromise of browser security properties including confidentiality, integrity, and availability of user data and browser processes. However, there are no reports of active exploitation in the wild at this time.

A fixed version of Google Chrome is available starting from version 147.0.7727.138. Users and administrators should update their Chrome installations to this version or later to remediate the vulnerability. Since this is not a cloud service, remediation depends on applying the update locally. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for details.