This vulnerability involves a use-after-free condition in the Media module of Google Chrome on Android before version 147.0.7727.138. Exploitation requires the attacker to have already compromised the renderer process and involves delivering a crafted HTML page to trigger a sandbox escape. The CVSS vector indicates network attack vector, high complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor advisory URL is provided but does not explicitly state patch or remediation details.

Successful exploitation could allow an attacker to escape the Chrome sandbox on Android, potentially leading to full compromise of the affected device's browser environment. The impact includes complete loss of confidentiality, integrity, and availability within the sandboxed process. No known active exploitation has been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Until confirmation of a fix, users should exercise caution when browsing untrusted content on affected Chrome versions. No specific temporary mitigations are detailed in the available data.