Google Chrome is vulnerable to a heap buffer overflow that could allow an attacker to achieve arbitrary code execution or system compromise if a user is convinced to install a malicious extension.

This vulnerability is a heap buffer overflow (CWE-122) located in the Base component of the Chrome browser. An attacker can trigger this flaw by tricking a user into installing a malicious extension, which leverages the overflow to corrupt memory and potentially execute arbitrary code.

Successful exploitation of this vulnerability allows an attacker to gain control over the affected browser process, potentially leading to unauthorized data access, system instability, or further compromise of the host machine. With a CVSS score of 7.5, this issue is rated as High severity, reflecting the significant risk of remote exploitation and the potential for total loss of confidentiality, integrity, and availability within the context of the browser environment.

Immediate Action: Update Google Chrome to version 151.0.7922.109 or later across all managed endpoints to apply the necessary security patches.

Proactive Monitoring: Monitor browser-related logs and endpoint security telemetry for unusual processes or unauthorized extension installations that deviate from organizational security policies.

Compensating Controls: Enforce strict browser extension management policies, such as blocking the installation of unauthorized or third party extensions, to minimize the attack surface.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the High severity rating and the potential for full compromise of the browser process, organizations should treat this vulnerability with urgency. Administrators must ensure that all instances of Google Chrome are updated to the latest version immediately to mitigate the risk of heap corruption attacks.