A critical heap buffer overflow vulnerability in Google Chrome allows unauthenticated remote attackers to achieve a sandbox escape through maliciously crafted web content.

The vulnerability is a heap buffer overflow (CWE-122) within the Video component of the browser. It allows an unauthenticated remote attacker to escape the browser sandbox by enticing a user to visit a specially crafted HTML page.

The ability to escape the browser sandbox poses a significant risk to organizational endpoints, as it effectively removes the primary security boundary protecting the underlying operating system from malicious web content. With a CVSS score of 7.1, this high-severity flaw could lead to full system compromise, unauthorized data access, or the deployment of persistent malware if an attacker successfully pivots from the browser to the host machine.

Immediate Action: Update all instances of Google Chrome to version 141.0.7390.54 or later to apply the necessary security patches.

Proactive Monitoring: Monitor endpoint security logs for anomalous browser behavior or unexpected process execution patterns that may indicate a sandbox escape attempt.

Compensating Controls: Ensure that endpoint protection software is fully updated and configured to detect and block malicious web-based exploits, as these tools can often identify the underlying patterns of buffer overflow attacks.

Public Exploit Available: Unknown.

Given the high impact of a sandbox escape, organizations must prioritize the deployment of the Chrome update across all managed workstations. Administrators should utilize automated patch management systems to ensure all browsers are updated to the secure version, thereby neutralizing the risk of exploitation before an attacker can develop and deploy a functional exploit in the wild.