This vulnerability involves a use-after-free condition in the XR (Extended Reality) functionality of Google Chrome on Windows platforms before version 148.0.7778.216. Exploitation requires that an attacker first compromise the renderer process, after which they could leverage this flaw to perform a sandbox escape via a crafted HTML page. The CVSS score of 8.3 reflects high impact on confidentiality, integrity, and availability, with attack vector network, high attack complexity, no privileges required, user interaction required, and scope changed.

Successful exploitation could allow an attacker to escape the Chrome sandbox, potentially leading to full system compromise including unauthorized access to sensitive data and control over the affected system. The vulnerability affects confidentiality, integrity, and availability of the system. No active exploitation has been reported so far.

A fix is available in Google Chrome version 148.0.7778.216. Users and administrators should update affected Chrome installations to this version or later to remediate the vulnerability. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for detailed patch information and update instructions.