A critical sandbox escape vulnerability in Google Chrome on Android allows remote attackers to compromise the system, requiring an immediate update to version 151.0.7922.72 or later.

The vulnerability stems from insufficient validation of untrusted input within the Web Authentication component. This flaw permits a remote, unauthenticated attacker who has already compromised the renderer process to escape the browser sandbox and execute arbitrary code on the underlying Android device via a crafted HTML page.

The exploitation of this vulnerability carries a high risk to organizational data and device integrity. With a CVSS score of 9.6, this flaw allows for total system compromise, potentially leading to unauthorized access to sensitive user data, credential theft, or the installation of persistent malware. Because the flaw facilitates a sandbox escape, it effectively bypasses the primary security boundary of the mobile browser.

Immediate Action: Update all instances of Google Chrome on Android to version 151.0.7922.72 or later immediately to apply the vendor-provided security patches.

Proactive Monitoring: Review mobile device management (MDM) logs to identify outdated browser versions and monitor for unusual network traffic originating from mobile endpoints that may indicate a successful compromise.

Compensating Controls: While no direct virtual patch exists for this client-side flaw, ensure that mobile security suites are active to detect malicious payloads or unauthorized application behavior that may occur following a sandbox escape.

Public Exploit Available: No (there is no confirmed public exploit in the available data).

Given the critical nature of this vulnerability and the potential for complete device takeover, organizations should prioritize the deployment of the latest Chrome update across all managed Android devices. Timely patching is the only effective method to mitigate the risk of sandbox escape and subsequent malicious activity.