A high severity use after free vulnerability in Google Chrome on Mac could allow a remote attacker to escape the browser sandbox and execute arbitrary code.

This is a use after free vulnerability located in the TabStrip component. The flaw is triggered when an attacker, who has already compromised the renderer process, uses a crafted HTML page to perform a sandbox escape, requiring user interaction.

The ability to escape the browser sandbox poses a significant risk to organizational endpoints. By bypassing the security boundaries of the browser, an attacker may gain unauthorized access to the underlying operating system, leading to potential data theft, malware deployment, or full system compromise. With a CVSS score of 8.3, this vulnerability is classified as high severity, representing a substantial threat to workstation security.

Immediate Action: Update all Google Chrome instances on macOS to version 151.0.7922.137 or later immediately.

Proactive Monitoring: Review browser crash logs and system security alerts for signs of unusual process behavior or unexpected sandbox violations.

Compensating Controls: Ensure that users are operating with the principle of least privilege, as this limits the potential impact of a successful sandbox escape on the local host.

Public Exploit Available: Unknown

The vulnerability in Google Chrome represents a critical path for attackers to move from a browser-based exploit to full system control. Administrators must prioritize the deployment of the 151.0.7922.137 update across all Mac-based endpoints to ensure the TabStrip component is secured. Delaying this update increases the window of opportunity for attackers to leverage existing renderer process compromises for deeper system access.