This vulnerability involves a use-after-free condition (CWE-416) in the GPU subsystem of Google Chrome before version 147.0.7727.138. An attacker with control over the renderer process could trigger heap corruption by crafting malicious HTML content. The issue is rated high severity with a CVSS 3.1 score of 7.5, indicating network attack vector, high complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details.

Successful exploitation could lead to heap corruption, potentially allowing an attacker to execute arbitrary code or cause a denial of service within the Chrome browser. The attacker must have already compromised the renderer process and trick the user into interacting with malicious content. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Until official fixes are confirmed, users should exercise caution with untrusted web content and ensure Chrome is updated to the latest available version.