The vulnerability is a use‑after‑free bug in the XR (extended reality) component of Google Chrome on Windows. When a crafted HTML page is loaded, the application may dereference freed memory and execute arbitrary code. This flaw allows an attacker who can supply or influence the HTML content to run code with the privilege level of the user browsing the page. The weakness is a classic use‑after‑free (CWE‑416) and is considered a high‑severity security issue.

Any Windows installation running Google Chrome before version 148.0.7778.179 is vulnerable. The issue was tracked in Chromium issue 498702233 and a stable channel update was released on 2026‑05‑08 to fix the bug. Users of older builds on the stable channel should upgrade to the patched release; other channels (beta, dev, canary) are unaffected or have later patches.

The CVSS score of 8.8 indicates a high‑severity vulnerability, and the description labels it as high severity, permitting remote code execution. The EPSS score is unavailable, so the likelihood of exploitation is unclear; however, the fact that the vulnerability is triggered by a crafted web page suggests the attacker must make the target browsing a malicious page, which is typically user‑initiated. The flaw is not listed in the CISA KEV catalog, so no public exploit is documented at this time, but the potential for widespread impact remains high.