A type confusion vulnerability in Google Chrome allows for arbitrary code execution when a user installs a malicious extension, posing a significant risk to browser security.

This vulnerability involves a type confusion flaw within the V8 JavaScript engine. An attacker can trigger this issue by convincing a user to install a crafted malicious extension, which subsequently allows for arbitrary code execution within the browser sandbox.

The exploitation of this vulnerability leads to arbitrary code execution, which may result in the compromise of user data, browser session information, and potential lateral movement within the local environment. While the Chromium project classifies the internal severity as low, the CVSS score of 7.5 indicates a high risk due to the potential for total impact on confidentiality, integrity, and availability if the sandbox is bypassed.

Immediate Action: Update Google Chrome to version 151.0.7922.72 or later to apply the necessary security fixes for the V8 engine.

Proactive Monitoring: Monitor endpoint logs for the installation of unauthorized or suspicious browser extensions and audit browser configuration settings across the enterprise.

Compensating Controls: Implement organizational policies that restrict the installation of browser extensions to a pre-approved allowlist and utilize endpoint protection solutions to detect malicious process behavior.

Public Exploit Available: No (exploit_available: false)

Security teams should prioritize updating all Google Chrome instances to the latest stable release to remediate this V8 type confusion flaw. Given the reliance on user interaction, focus should also be placed on user awareness training regarding the risks associated with installing untrusted browser extensions.