This vulnerability involves a heap buffer overflow in the codecs processing of Google Chrome before version 148.0.7778.168. Exploitation requires a crafted video file that triggers the overflow, enabling remote code execution inside the sandbox environment. The issue was assigned CVE-2026-8529 and is classified with high security severity by Chromium. No detailed CVSS metrics are available, and no known active exploits have been reported. The vendor has published a stable channel update that includes a fix for this vulnerability.

Successful exploitation could allow a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome. This could lead to unauthorized actions or compromise of the browser process, although the sandbox limits broader system impact. There are no reports of active exploitation in the wild at this time.

A fixed version of Google Chrome (148.0.7778.168) has been released that addresses this heap buffer overflow vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is not a cloud service, remediation depends on applying the update on client systems. Patch status is confirmed by the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html.