A critical use after free vulnerability in Google Chrome allows remote attackers to escape the browser sandbox and potentially execute arbitrary code on the underlying host.

This is a use after free vulnerability (CWE-416) within the Views component. An unauthenticated remote attacker can trigger this flaw via a crafted HTML page to compromise the renderer process and subsequently perform a sandbox escape.

The ability to escape the browser sandbox represents a critical security failure, as it allows an attacker to bypass the primary security boundary protecting the host operating system. A successful exploit could lead to full system compromise, unauthorized data access, and the execution of malicious code with the privileges of the user running the browser. Given the CVSS score of 9.6, this vulnerability poses an extreme risk to organizational integrity and data confidentiality.

Immediate Action: Update all Google Chrome instances to version 151.0.7922.72 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor endpoint logs for unusual browser process behavior or unexpected crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that browser-based security policies are enforced and utilize endpoint protection platforms to detect malicious activity originating from browser processes.

Public Exploit Available: No — exploit_available (false).

Due to the critical nature of this sandbox escape vulnerability, organizations must prioritize the deployment of the latest Chrome update across all managed workstations. Failure to patch this flaw leaves systems exposed to potential remote code execution and total system compromise by attackers leveraging malicious web content.