This vulnerability involves an inappropriate implementation in the V8 JavaScript engine used by Google Chrome before version 148.0.7778.216. It enables remote code execution inside the sandbox environment via a specially crafted HTML page. The issue is categorized as CWE-94, indicating improper control over code generation, which can lead to execution of arbitrary code. The CVSS 3.1 base score of 8.8 reflects high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The vulnerability was published on May 28, 2026. The vendor advisory URL is provided but does not explicitly confirm patch availability or remediation details in the input data.

Successful exploitation allows a remote attacker to execute arbitrary code within the sandboxed environment of Google Chrome, potentially compromising the confidentiality, integrity, and availability of the affected system. This could lead to unauthorized actions within the browser context. No known exploits in the wild have been reported at the time of this analysis.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users should update Google Chrome to version 148.0.7778.216 or later once confirmed patched. Until then, exercise caution when browsing untrusted websites and avoid interacting with suspicious HTML content.