This vulnerability involves a use-after-free condition in the Media module of Google Chrome before version 147.0.7727.138. Exploiting this issue could enable remote code execution inside the sandbox environment via a maliciously crafted HTML page. The CVSS v3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. The vulnerability requires no privileges and low attack complexity but does require user interaction. The vendor advisory link is available but does not explicitly confirm patch availability in the provided data.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of the browser, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score reflects significant impact, though no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official updates from Google Chrome promptly once available.