This vulnerability involves a use-after-free condition in the Views component of Google Chrome before version 148.0.7778.216. Exploitation requires that an attacker first compromise the renderer process and then use a crafted PDF file to trigger the vulnerability, potentially enabling sandbox escape. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The issue was publicly disclosed on May 28, 2026, and Google has released a stable channel update to address it.

Successful exploitation could allow an attacker to escape the Chrome sandbox, potentially gaining higher privileges on the host system. This could lead to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires prior compromise of the renderer process and user interaction (opening a crafted PDF). No known exploits are reported in the wild at this time.

Google has released an official stable channel update to fix this vulnerability in Chrome version 148.0.7778.216. Users and administrators should apply this update promptly to mitigate the risk. Since this is a client-side application vulnerability, no additional vendor-managed remediation applies. Patch status is confirmed by the vendor advisory. No further action is required beyond updating to the fixed version or later.