This vulnerability involves a use-after-free condition in the WebView component of Google Chrome on Android before version 147.0.7727.138. Exploitation requires user interaction (UI required) and can lead to remote code execution within the sandbox environment. The CVSS vector indicates the attack can be performed remotely over the network with low complexity and no privileges required. The impact includes high confidentiality, integrity, and availability consequences.

Successful exploitation allows a remote attacker to execute arbitrary code inside the sandbox on affected Android devices running vulnerable Chrome versions. This can compromise the confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild, reducing immediate risk but the potential impact remains high.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when interacting with untrusted web content. Monitor the vendor advisory for updates on patch availability.