This vulnerability involves a use-after-free condition in the UI of Google Chrome before version 148.0.7778.96. Exploitation requires prior compromise of the renderer process and can lead to arbitrary code execution within the sandbox environment via a specially crafted HTML page. The issue is publicly documented as CVE-2026-7991 with a medium severity rating by Chromium security. No CVSS score is provided. The vendor advisory linked corresponds to a stable channel update that presumably includes the fix.

Successful exploitation allows an attacker with control over the renderer process to execute arbitrary code inside the sandbox, potentially enabling further compromise within the sandboxed environment. However, exploitation requires prior renderer compromise, limiting the initial attack vector. There are no known exploits in the wild at this time.

Users should update Google Chrome to version 148.0.7778.96 or later to remediate this vulnerability. The vendor advisory linked corresponds to the stable channel update addressing this issue. Patch status is effectively confirmed by the presence of the fixed version. No additional mitigation steps are indicated by the vendor advisory.