This vulnerability is an out of bounds memory access issue in the V8 JavaScript engine component of Google Chrome before version 148.0.7778.96. Exploitation requires a user to visit a maliciously crafted HTML page, which could trigger arbitrary code execution inside the sandboxed environment of the browser. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. The vulnerability is tracked as CWE-125 (out-of-bounds read/write).

Successful exploitation could allow an attacker to execute arbitrary code within the sandbox of the affected Chrome browser, potentially leading to full compromise of the browser process. This impacts confidentiality, integrity, and availability of the user's browsing environment. No known active exploits have been reported, but the high CVSS score reflects the critical nature of the flaw.

The vendor advisory linked references a stable channel update for Chrome but does not explicitly confirm patch availability in the provided data. Since the vulnerability affects versions prior to 148.0.7778.96, updating to version 148.0.7778.96 or later is strongly recommended. Patch status is not yet confirmed—check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance.