This vulnerability involves a use-after-free condition in the XR subsystem of Google Chrome on Windows platforms before version 148.0.7778.179. Exploitation requires a remote attacker to deliver a crafted HTML page that triggers the flaw, potentially leading to arbitrary code execution. The issue was publicly disclosed on May 20, 2026, and is rated as high severity by Chromium security. The vendor advisory URL is provided but does not explicitly state the patch or remediation status in the input data.

Successful exploitation of this vulnerability could allow remote code execution within the context of the affected Chrome browser on Windows. This could lead to full compromise of the user's browser process and potentially the underlying system depending on user privileges. No known active exploits have been reported, reducing immediate risk, but the high severity rating indicates significant potential impact if exploited.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html for current remediation guidance. Users should update to Chrome version 148.0.7778.179 or later once available. Until then, avoid visiting untrusted or suspicious websites that could host crafted HTML content triggering this vulnerability.