This vulnerability involves a use-after-free condition in the Canvas implementation of Google Chrome on Linux and ChromeOS platforms before version 147.0.7727.138. Exploitation requires a user to visit a maliciously crafted HTML page, which can trigger arbitrary code execution inside the sandboxed environment of the browser. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue is classified as critical by Chromium security.

Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code within the sandbox of the affected Chrome browser, potentially compromising the confidentiality, integrity, and availability of the user's environment. However, the attack requires user interaction (visiting a crafted HTML page). There are no reports of active exploitation in the wild.

A fix for this vulnerability is available as part of the Chrome stable channel update version 147.0.7727.138. Users and administrators should update affected Chrome installations to this version or later to remediate the issue. Refer to the official Google Chrome release blog for the update details: https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop_28.html