This vulnerability involves a use-after-free condition in the Media module of Google Chrome versions before 148.0.7778.168. Exploitation requires user interaction (UI:R) and can lead to remote code execution inside the sandbox. The CVSS vector indicates the attack can be performed remotely over the network without privileges and with low attack complexity, impacting confidentiality, integrity, and availability at a high level. The issue was publicly disclosed on May 14, 2026, and Google has published a stable channel update announcement on the same date.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. However, no active exploitation in the wild has been reported to date.

The vendor has published a stable channel update announcement for Chrome version 148.0.7778.168, which is the fixed version addressing this vulnerability. Users and administrators should update to this version or later to remediate the issue. Patch status is not explicitly stated in the advisory content provided, so it is recommended to verify the update details in the vendor advisory URL. No additional mitigation steps are indicated.