This vulnerability involves a use-after-free condition in the XML processing of Google Chrome before version 148.0.7778.216. Exploiting this issue can enable remote code execution inside the sandbox via a crafted HTML page. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The vendor advisory is available but does not explicitly state patch or remediation details.

Successful exploitation could allow an attacker to execute arbitrary code within the sandboxed environment of the affected Chrome browser, potentially compromising user data and system integrity. The high CVSS score reflects the critical nature of this vulnerability affecting confidentiality, integrity, and availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official confirmation of a fix is available, users should exercise caution when browsing untrusted websites and consider applying any available Chrome updates promptly once released.