A critical integer overflow vulnerability in Google Chrome on Windows exposes users to potential heap corruption and remote code execution if they visit a malicious website.

This is an integer overflow flaw (CWE-472) located within the ANGLE graphics engine component. The vulnerability is exploitable by an unauthenticated remote attacker who can induce heap corruption by enticing a user to navigate to a crafted HTML page.

The vulnerability carries a CVSS score of 8.8, reflecting its potential for severe impact on confidentiality, integrity, and availability. Successful exploitation could allow an attacker to execute arbitrary code within the context of the browser, potentially leading to unauthorized data access, system compromise, or the installation of malware on the host machine.

Immediate Action: Update Google Chrome to version 146.0.7680.153 or later immediately to include the necessary security patches.

Proactive Monitoring: Monitor endpoint security logs for unusual browser activity or unexpected process crashes that may indicate exploitation attempts.

Compensating Controls: Ensure that browser security settings are strictly enforced via Group Policy and consider using endpoint protection platforms that can detect memory corruption patterns.

Public Exploit Available: No

Given the high severity of this vulnerability and the ubiquity of Google Chrome in enterprise environments, organizations should prioritize the deployment of the version 146.0.7680.153 update across all Windows workstations. Failure to patch creates a significant window of opportunity for attackers to leverage heap corruption for potential remote code execution.