This vulnerability (CWE-416) involves a use-after-free condition in the Animation subsystem of Google Chrome before version 147.0.7727.138. Exploitation requires user interaction (UI:R) and can be triggered remotely over the network (AV:N) without privileges (PR:N). Successful exploitation could lead to full confidentiality, integrity, and availability compromise within the sandboxed environment. The CVSS vector indicates low attack complexity and no scope change.

An attacker who successfully exploits this vulnerability can execute arbitrary code inside the Chrome sandbox, potentially leading to full compromise of the browser process. This could allow unauthorized actions such as data theft, manipulation, or denial of service within the context of the browser. However, no active exploits have been reported so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution when visiting untrusted websites and consider using additional browser security features or mitigations. Monitor official Google Chrome release notes for updates.