This vulnerability involves a use-after-free condition in the Blink rendering engine of Google Chrome before version 148.0.7778.96. Exploitation requires a remote attacker to craft malicious HTML content that triggers the flaw, potentially leading to arbitrary code execution inside the sandboxed environment of the browser. The issue is recognized by the Chromium project and assigned medium severity. No CVSS score is available, and no explicit remediation level is provided in the input data. The vendor advisory URL is available but does not specify patch details in the provided content.

Successful exploitation could allow remote code execution within the sandboxed context of the Chrome browser, potentially compromising browser security and user data confidentiality. However, the impact is limited by the sandbox containment. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users should update to Chrome version 148.0.7778.96 or later once available. Until then, exercise caution when visiting untrusted websites or opening untrusted HTML content.