This vulnerability involves a use-after-free condition in the WebRTC implementation of Google Chrome before version 148.0.7778.216. Exploitation requires user interaction (visiting a malicious HTML page) and could lead to arbitrary code execution within the sandbox environment. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The vendor advisory linked confirms a stable channel update that fixes the issue.

Successful exploitation allows remote attackers to execute arbitrary code inside the sandboxed environment of the browser, potentially compromising user data and system integrity. The high CVSS score reflects the critical nature of the vulnerability affecting confidentiality, integrity, and availability. No known active exploits have been reported.

A fix is available in Google Chrome version 148.0.7778.216. Users and administrators should update to this version or later to remediate the vulnerability. Since this is not a cloud service, patching the client software is required. Refer to the official Google Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html for detailed update instructions.