This vulnerability involves a use-after-free condition in the Codecs module of Google Chrome before version 147.0.7727.138. Exploitation requires a remote attacker to deliver a specially crafted HTML page that triggers the flaw, enabling arbitrary code execution inside the browser sandbox. The issue is acknowledged by the Chromium security team as high severity. Although no CVSS score or explicit remediation level is provided, the presence of the fixed version suggests that updating Chrome to 147.0.7727.138 or later mitigates the vulnerability. No evidence of active exploitation has been reported.

Successful exploitation could allow a remote attacker to execute arbitrary code within the sandboxed environment of the Chrome browser, potentially leading to unauthorized actions or compromise of the browser process. The impact is limited to the browser sandbox and does not indicate broader system compromise from the provided data. No known exploits in the wild have been reported.

Users should update Google Chrome to version 147.0.7727.138 or later to remediate this vulnerability. Since this is a client-side vulnerability in a non-cloud product, applying the official update is the recommended mitigation. Patch status is not explicitly confirmed in the vendor advisory, so users should consult the official Chrome release notes at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for the latest remediation guidance.