A high severity use after free vulnerability in Google Chrome allows remote attackers to execute arbitrary code via malicious extensions, posing a significant risk to end-user systems.

This is a use after free flaw (CWE-416) within the Extensions component of the browser. Successful exploitation requires an unauthenticated attacker to convince a user to install a specially crafted extension, which subsequently allows code execution inside the browser sandbox.

The ability to execute arbitrary code within the browser sandbox presents a severe risk to organizational data and system integrity. While the vulnerability requires user interaction, a successful exploit could lead to complete compromise of the browser environment, potential theft of session tokens, and unauthorized access to sensitive web applications. The CVSS score of 7.5 reflects the high impact on confidentiality, integrity, and availability.

Immediate Action: Update Google Chrome to version 151.0.7922.137 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review browser extension audit logs and monitor for unusual extension installation patterns or unexpected browser crashes that may indicate exploitation attempts.

Compensating Controls: Implement organizational policies that restrict the installation of third-party browser extensions to only those verified and approved by the IT security team.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, this vulnerability should be treated with high priority. Administrators must ensure that the update to version 151.0.7922.137 is deployed across all endpoints to remediate the use after free flaw. Furthermore, reinforcing user education regarding the dangers of installing unverified browser extensions is essential to mitigating the primary attack vector.