This vulnerability involves a use-after-free condition in the SurfaceCapture functionality of Google Chrome before version 148.0.7778.216. Exploitation requires a user to visit a specially crafted HTML page, which can trigger heap corruption. The CVSS vector indicates the attack can be performed remotely without privileges, requires user interaction, and impacts confidentiality, integrity, and availability with high severity. The issue is publicly disclosed with a vendor advisory but lacks explicit patch or remediation details in the provided data.

Successful exploitation could allow an attacker to execute arbitrary code or cause denial of service by corrupting memory in the browser process. This impacts the confidentiality, integrity, and availability of the affected system. No confirmed active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for current remediation guidance. Users and administrators should monitor official Google Chrome release notes and update to the latest stable version once a fix is confirmed available.