This vulnerability involves a use-after-free condition in the Media component of Google Chrome on Windows platforms before version 148.0.7778.216. Exploitation requires a remote attacker to craft a malicious HTML page that triggers the flaw, potentially enabling arbitrary code execution inside the browser's sandbox environment. The issue was publicly disclosed on May 28, 2026, with a Google Chrome stable channel update announcement linked as the vendor advisory. However, the advisory does not explicitly state whether the update fully addresses the vulnerability or if additional mitigations are necessary.

Successful exploitation could lead to arbitrary code execution within the sandboxed environment of Google Chrome on affected Windows versions. This may allow attackers to run malicious code remotely via a specially crafted HTML page. No evidence of active exploitation in the wild has been reported. The vulnerability is rated as high severity by Chromium security, indicating significant risk if exploited.

The vendor advisory linked corresponds to a stable channel update for Google Chrome version 148.0.7778.216. Although explicit patch confirmation is not stated, the affected version list indicates that updating to version 148.0.7778.216 or later is expected to remediate the vulnerability. Users should apply the latest stable Chrome update promptly. Patch status is not yet fully confirmed; users should monitor the vendor advisory for any additional remediation instructions.