This vulnerability involves a use-after-free condition in Blink, the rendering engine used by Google Chrome. Exploiting this flaw enables remote code execution inside the sandbox environment via a specially crafted HTML page. The affected versions are all Chrome releases prior to 148.0.7778.168. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state the patch or remediation status.

Successful exploitation could allow an attacker to execute arbitrary code within the sandboxed environment of the browser, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions within the browser context. No known exploits are reported in the wild, reducing immediate risk but the vulnerability remains critical due to its potential impact.

Google has published a vendor advisory for this vulnerability. However, the provided information does not explicitly confirm whether a patch or official fix is available. Users should consult the Google Chrome release blog at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for the latest remediation status and apply updates promptly if a fix is released. Until then, cautious browsing and avoiding untrusted HTML content can reduce exposure.