Google Chrome is vulnerable to a critical integer overflow in its ANGLE component, which could allow a remote attacker to escape the browser sandbox and execute arbitrary code.

This vulnerability is an integer overflow (CWE-190) within the ANGLE graphics library that is triggered when processing malicious HTML content. The flaw requires user interaction to visit a crafted page, but once triggered, it allows an unauthenticated remote attacker to escape the browser sandbox.

The ability to escape the browser sandbox represents a significant security risk, as it effectively bypasses the primary isolation layer protecting the host operating system from malicious web content. Given the CVSS score of 9.6, this vulnerability poses a high risk of complete system compromise, including unauthorized data access and the execution of arbitrary code with user privileges. Failure to patch this flaw could lead to severe security breaches, especially in environments where users frequently navigate to untrusted or external websites.

Immediate Action: Update Google Chrome to version 151.0.7922.72 or later immediately to incorporate the necessary security patches for the ANGLE component.

Proactive Monitoring: Monitor browser logs and endpoint security telemetry for unusual process spawning or attempts to access restricted file system paths originating from the browser process.

Compensating Controls: While browser-level patches are the only definitive fix, ensure endpoint detection and response (EDR) solutions are configured to detect common sandbox escape patterns and exploit behaviors.

Public Exploit Available: Unknown

This vulnerability carries a critical severity rating and presents a direct threat to the integrity and confidentiality of end-user workstations. Organizations must prioritize the deployment of the latest Chrome update across all managed assets to mitigate the risk of sandbox exploitation. Given the potential for remote code execution, delaying this update is not recommended.