An out-of-bounds write vulnerability exists in the Media component of Google Chrome on Mac and iOS versions before 148.0.7778.96. This vulnerability enables a remote attacker, with prior renderer process compromise, to execute arbitrary code inside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed with a vendor advisory pointing to a stable channel update, but no explicit patch or remediation level is stated in the input data.

Successful exploitation allows remote code execution within the sandboxed environment of the Chrome renderer process, potentially compromising confidentiality, integrity, and availability of the affected system. The vulnerability requires user interaction and prior compromise of the renderer process, limiting but not eliminating risk. No known active exploits have been reported.

The vendor has published a stable channel update advisory for Chrome, which likely includes a fix for this vulnerability. However, the patch status is not explicitly confirmed in the provided data. Users should update Google Chrome on Mac and iOS to version 148.0.7778.96 or later once available. Until confirmation, check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for the latest remediation guidance.