This vulnerability is an out-of-bounds read in the AdFilter feature of Google Chrome versions before 148.0.7778.96. Exploitation requires a user to interact with a maliciously crafted HTML page, which can lead to arbitrary code execution inside the browser's sandbox environment. The CVSS vector indicates the attack can be performed remotely over the network without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. The vulnerability was publicly disclosed on May 6, 2026, and Google has published a stable channel update announcement, but explicit patch status is not detailed in the provided advisory.

Successful exploitation allows remote attackers to execute arbitrary code within the sandbox of the affected Chrome browser, potentially compromising confidentiality, integrity, and availability of the user's environment. This could lead to unauthorized actions or data exposure within the sandboxed context. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Users and administrators should monitor this advisory for updates and apply any official Chrome updates promptly once confirmed available.