This vulnerability involves a use-after-free condition in the ReadingMode feature of Google Chrome before version 148.0.7778.96. Exploitation requires prior compromise of the renderer process and involves delivering a crafted HTML page to trigger arbitrary code execution inside the sandbox environment. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details.

Successful exploitation allows remote code execution within the sandboxed renderer process, potentially leading to significant confidentiality, integrity, and availability impacts on the affected system. However, exploitation requires prior compromise of the renderer process and user interaction, which limits the attack surface. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Until official confirmation, users should update to the latest Chrome version once available. No other specific mitigations are indicated by the vendor advisory.