This vulnerability involves an integer overflow in PDFium, a PDF rendering engine used by Google Chrome. The flaw exists in Chrome versions before 148.0.7778.216 and can be exploited by an attacker who has compromised the renderer process to execute arbitrary code inside the sandbox via a crafted font file. The Chromium security team rates this vulnerability as high severity. The vendor advisory is available but does not explicitly confirm patch availability or remediation details.

Successful exploitation could allow an attacker with access to the renderer process to execute arbitrary code within the sandbox environment. This could potentially lead to further compromise of the browser's security boundaries. However, exploitation requires prior compromise of the renderer process, limiting the initial attack vector. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Until official confirmation of a fix is available, users should ensure they are running the latest Chrome version and follow any updates from Google regarding this issue.