This vulnerability involves a use-after-free condition in the Passwords feature of Google Chrome before version 148.0.7778.96. Exploitation requires user interaction (UI:R) and can be triggered remotely via a crafted HTML page, potentially allowing arbitrary code execution with no privileges required. The CVSS vector indicates the attack can be performed over the network with low complexity and results in high impact on confidentiality, integrity, and availability.

Successful exploitation could allow a remote attacker to execute arbitrary code on the affected system, compromising user data and system integrity. The vulnerability affects confidentiality, integrity, and availability at a high level. No known active exploits have been reported, which may reduce immediate risk but does not eliminate the threat.

The vendor has released a stable channel update as referenced in the advisory (https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html). Although the explicit patch status is not stated in the provided data, the presence of this update strongly suggests that a fix is available in Chrome version 148.0.7778.96 or later. Users and administrators should update to the latest stable Chrome version to mitigate this vulnerability. Patch status is not yet fully confirmed in the input data; verify the vendor advisory for current remediation guidance.