The flaw is a use‑after‑free in ANGLE, the graphics abstraction layer used by Google Chrome. The vulnerability, which exists in all Chrome releases prior to 148.0.7778.216, can be triggered by a crafted HTML page that is loaded by a renderer process that an attacker has already compromised. When triggered, the attacker can execute arbitrary code with the privileges of that renderer process, effectively gaining code‑execution rights on the host system. This matches CWE‑416 (Use After Free) and CWE‑825 (Exploitation of Memory Management).

Google Chrome for desktop. Versions before 148.0.7778.216 are affected, as noted in the Chrome security release for May 2026. All users running those builds are at risk, especially if they have not applied recent security updates.

The CVSS score of 7.5 places this vulnerability in the High severity range. The EPSS score of less than 1% indicates a very low likelihood of exploitation at present, but the prerequisite of an already compromised renderer process suggests that the attack vector requires remote access to the browser via malicious content. The vulnerability is not listed in the CISA KEV catalog, so no known exploited instances have been published yet. The attack is inferred to be remote and mediated via the web.