This vulnerability involves a use-after-free condition (CWE-416) in the Navigation functionality of Google Chrome before version 147.0.7727.138. Exploitation requires user interaction (UI:R) and can be triggered remotely via a crafted HTML page, potentially leading to arbitrary code execution. The CVSS vector indicates the attack can be performed over the network without privileges and with low attack complexity. The flaw impacts confidentiality, integrity, and availability at a high level.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system, compromising confidentiality, integrity, and availability. This could lead to full control over the victim's browser environment and potentially the underlying system depending on sandbox escapes and other mitigations.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and consider using additional security controls such as sandboxing or disabling JavaScript where feasible.