This vulnerability is an out-of-bounds read in the GPU subsystem of Google Chrome versions before 148.0.7778.179. It allows remote attackers to potentially cause heap corruption by crafting malicious HTML content. The CVSS vector indicates the attack requires no privileges but user interaction, and it impacts confidentiality, integrity, and availability with high severity. The issue was publicly disclosed on May 20, 2026, with a vendor advisory published by Google. However, explicit patch or remediation details are not provided in the input data.

Successful exploitation could lead to heap corruption, potentially allowing an attacker to execute arbitrary code or cause denial of service. The vulnerability affects the confidentiality, integrity, and availability of the affected system. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0841193308.html for current remediation guidance. Users should update to Chrome version 148.0.7778.179 or later once available. Until official confirmation, avoid visiting untrusted or suspicious websites that could host crafted HTML content exploiting this vulnerability.