This vulnerability involves a use-after-free condition in the WebAppInstalls feature of Google Chrome on Mac platforms before version 148.0.7778.216. Exploitation requires user interaction through specific UI gestures and a maliciously crafted HTML page, which may cause heap corruption. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on May 28, 2026, and a stable channel update from Google addresses the vulnerability.

Successful exploitation could allow a remote attacker to cause heap corruption, potentially leading to arbitrary code execution or browser compromise. The impact affects confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction and specific UI gestures, which may limit the attack surface. No active exploits have been reported.

Google has released a stable channel update for Chrome version 148.0.7778.216 that fixes this vulnerability. Users and administrators should update to this version or later to remediate the issue. Since this is a client-side vulnerability requiring user interaction, applying the official update is the primary mitigation. No additional vendor-recommended mitigations are indicated.