This vulnerability involves a use-after-free condition in the Network module of Google Chrome before version 148.0.7778.216. Exploitation requires a user interaction (UI:R) and can be triggered remotely via a specially crafted HTML page, potentially allowing arbitrary code execution within the sandbox environment. The CVSS vector indicates the attack complexity is low, no privileges are required, and the impact on confidentiality, integrity, and availability is high. The vulnerability was publicly disclosed on May 28, 2026, with a vendor advisory linked but without explicit patch status in the provided data.

Successful exploitation could allow a remote attacker to execute arbitrary code inside the sandboxed environment of the browser, potentially compromising confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the significant risk posed by this vulnerability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users and administrators should monitor this advisory closely and apply updates from Google Chrome as soon as they become available to mitigate this vulnerability.