An integer overflow vulnerability exists in the Fonts handling of Google Chrome before version 148.0.7778.168. This vulnerability allows remote code execution inside the sandbox environment when a user visits a maliciously crafted HTML page. The issue was publicly disclosed on May 14, 2026, with a medium severity rating assigned by Chromium security. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation details.

Successful exploitation could enable an attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the browser's security boundaries. However, the impact is limited to sandboxed code execution, and no known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_12.html for current remediation guidance. Users should update to version 148.0.7778.168 or later once confirmed. Until then, no specific mitigation steps are detailed by the vendor.