A critical use after free vulnerability in Google Chrome allows remote attackers to escape the browser sandbox and execute arbitrary code.

This is a use after free vulnerability (CWE-416) occurring within the Input component of the browser. It allows an unauthenticated remote attacker who has already compromised the renderer process to trigger a memory corruption flaw, leading to a sandbox escape.

The ability to escape the browser sandbox represents a significant security failure that effectively bypasses the primary isolation mechanism protecting the underlying operating system. With a CVSS score of 9.6, this flaw poses a severe risk of full system compromise, unauthorized data access, and persistent malware installation. Organizations should treat this as a high priority threat to workstation and server integrity.

Immediate Action: Update all Google Chrome instances to version 151.0.7922.72 or later immediately to incorporate the security patches provided by the vendor.

Proactive Monitoring: Review endpoint security logs for unusual browser crashes or unexpected process behavior originating from the Chrome renderer process.

Compensating Controls: Ensure that modern browser-based security features, such as Site Isolation, are enabled, and deploy endpoint detection and response (EDR) solutions to monitor for unauthorized process elevation attempts.

Public Exploit Available: Unknown

Given the critical CVSS severity and the potential for sandbox escape, organizations must prioritize the rapid deployment of the latest Chrome update across all managed environments. Failure to patch this vulnerability leaves endpoints susceptible to remote code execution and full system compromise by sophisticated threat actors.