A high-severity use-after-free vulnerability in Google Chrome could allow a remote attacker to achieve arbitrary code execution or cause a crash via a malicious webpage.

This is a use-after-free vulnerability (CWE-416) within the Base component of the browser. It allows an unauthenticated remote attacker to trigger heap corruption when a user visits a specially crafted HTML page.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for significant impact on system integrity and availability. Successful exploitation could lead to arbitrary code execution within the context of the browser, potentially allowing an attacker to bypass security controls, steal sensitive session data, or compromise the underlying host system.

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later as specified in the vendor security advisory.

Proactive Monitoring: Monitor endpoint security logs for unusual browser crashes or unexpected process spawned by the Chrome executable.

Compensating Controls: Ensure that users are operating under the principle of least privilege to limit the impact of successful code execution if the browser is compromised.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a significant risk to organizational assets. Administrators should prioritize the deployment of the latest Chrome security updates across all workstations to mitigate the threat of heap corruption and unauthorized code execution.