This vulnerability in Google Chrome (Linux and ChromeOS) stems from insufficient validation of untrusted input within the UI, enabling remote code execution when a user engages with a maliciously crafted HTML page using specific UI gestures. The CVSS score of 8.8 indicates high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. The vulnerability affects versions prior to 148.0.7778.96. The vendor advisory URL suggests a stable channel update was released on May 6, 2026, which likely includes the fix.

Successful exploitation allows remote attackers to execute arbitrary code on affected systems running vulnerable versions of Google Chrome on Linux and ChromeOS. This compromises system confidentiality, integrity, and availability. Exploitation requires user interaction via specific UI gestures on a crafted HTML page. There are no known exploits in the wild at the time of publication.

Users and administrators should update Google Chrome on Linux and ChromeOS to version 148.0.7778.96 or later, as indicated by the affectedVersions field and the vendor's stable channel update announcement. Since the vendor advisory does not explicitly state remediation level, this update should be considered the official fix. No additional mitigation steps are specified by the vendor.