This vulnerability involves a use-after-free condition in the ServiceWorker implementation of Google Chrome before version 148.0.7778.96. Exploiting this flaw could enable a remote attacker to execute code outside the browser sandbox, increasing the risk of system compromise. The CVSS 3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The issue was publicly disclosed on May 6, 2026, and Google has released a stable update to remediate it.

Successful exploitation may allow an attacker to escape the Chrome sandbox, potentially leading to arbitrary code execution with elevated privileges on the host system. This could compromise system confidentiality, integrity, and availability. No known exploits are reported in the wild, but the high CVSS score indicates significant risk if exploited.

Google has released an official stable channel update for Chrome version 148.0.7778.96 that addresses this vulnerability. Users and administrators should apply this update promptly to mitigate the risk. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated by the vendor.