This vulnerability involves an inappropriate implementation in the MHTML feature of Google Chrome before version 148.0.7778.96. An attacker with control over the renderer process can exploit this flaw to inject arbitrary scripts or HTML content, leading to UXSS. The issue is classified as low severity by Chromium security. No CVSS score or detailed remediation information is provided. The vendor advisory references a stable channel update but does not explicitly state if this update addresses the vulnerability.

The impact is limited to scenarios where an attacker has already compromised the renderer process, enabling them to inject arbitrary scripts or HTML via crafted MHTML content. This can lead to UXSS, potentially allowing script execution in the context of the affected browser. The severity is considered low by Chromium security, indicating limited risk or difficulty in exploitation.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects versions prior to 148.0.7778.96, updating to this or a later version is recommended if confirmed by the vendor advisory. No additional mitigation recommendations are provided by the vendor advisory.