This vulnerability involves a use-after-free condition in the GPU subsystem of Google Chrome before version 148.0.7778.96. Exploitation requires prior compromise of the renderer process and could enable sandbox escape through crafted HTML content. The CVSS 3.1 vector indicates network attack vector, high complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The issue is addressed in the Chrome stable channel update referenced in the vendor advisory.

Successful exploitation could allow an attacker with control over the renderer process to escape the Chrome sandbox, potentially leading to full system compromise or unauthorized access to sensitive information. The vulnerability affects confidentiality, integrity, and availability of the affected system. No active exploitation has been reported so far.

A fix is available in Google Chrome version 148.0.7778.96 and later. Users and administrators should update to this version or a newer stable release to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for detailed update instructions.