A high-severity heap buffer overflow in Google Chrome allows remote attackers to perform unauthorized memory reads, posing a significant risk of data exposure.

This vulnerability is a heap-based buffer overflow (CWE-122) located in the Sync component. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a malicious HTML page, leading to an out of bounds memory read.

The vulnerability carries a CVSS score of 8.1, reflecting a high risk of sensitive information disclosure. Successful exploitation could allow an attacker to bypass browser security boundaries, potentially leading to the theft of user data or session information stored within the synchronization component. This poses a severe threat to organizational confidentiality and user privacy.

Immediate Action: Update all instances of Google Chrome to version 141.0.7390.65 or later to resolve the underlying memory management flaw.

Proactive Monitoring: Monitor browser-based traffic for unusual patterns or access to suspicious external domains that may be attempting to trigger memory corruption errors.

Compensating Controls: Deploy endpoint protection solutions capable of detecting malicious web content and ensure that browser security settings are configured to restrict scripts and unauthorized content execution.

Public Exploit Available: No (exploit_available: false)

Given the high CVSS severity and the nature of heap-based memory vulnerabilities, immediate patching is essential to maintain browser security. IT administrators should prioritize the deployment of the 141.0.7390.65 update across the environment to mitigate the risk of remote information disclosure.