This vulnerability arises from insufficient validation of data within the InterestGroups component of Google Chrome before version 148.0.7778.96. An attacker with control over the renderer process could leverage this weakness to perform a sandbox escape, bypassing Chrome's security boundaries. The issue is classified as CWE-20 and carries a high CVSS score of 8.3, reflecting its potential impact on confidentiality, integrity, and availability. Although the vulnerability is publicly disclosed, the vendor advisory does not explicitly state whether an official fix has been released.

If exploited, this vulnerability could allow an attacker who has compromised the renderer process to escape the sandbox environment, potentially gaining higher privileges and executing arbitrary code outside the intended security boundaries. This could lead to full compromise of the affected system's user context. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should exercise caution with untrusted web content and consider limiting exposure to potentially malicious HTML pages that could exploit this vulnerability.