This vulnerability involves script injection in the SanitizerAPI component of Google Chrome on Android platforms before version 148.0.7778.168. An attacker can exploit this by delivering a crafted HTML page that injects arbitrary scripts or HTML, leading to a UXSS vulnerability. The issue was publicly disclosed on May 14, 2026, with a high severity rating by Chromium security. The vendor advisory URL is provided but does not specify the patch status or remediation details. The vulnerability affects the specified Chrome Android versions and is not related to cloud services.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts or HTML in the context of the affected browser, potentially leading to unauthorized actions or data exposure within the user's browsing session. However, there are no reports of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to version 148.0.7778.168 or later once confirmed available. No other specific mitigations are indicated in the advisory.