A heap buffer overflow vulnerability in Google Chrome's PDFium component could allow a remote attacker to achieve arbitrary code execution via a malicious PDF file.

This is a memory corruption vulnerability (CWE-122) within the PDFium engine, which handles PDF documents in the browser. The attack is unauthenticated and requires user interaction, such as opening a malicious document, to trigger the heap overflow.

The successful exploitation of this vulnerability can lead to memory corruption, potentially allowing an attacker to execute arbitrary code within the context of the user's browser. Given the CVSS score of 8.8, this poses a high risk of total system compromise, unauthorized data access, and potential lateral movement within the network if the browser is used to access internal services.

Immediate Action: Update all installations of Google Chrome to version 146.0.7680.153 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor endpoint security logs for unusual browser crashes or unexpected child process activity that may indicate attempts to trigger the PDFium heap overflow.

Compensating Controls: While no direct virtual patch exists for this memory flaw, enforcing strict browser security policies and utilizing endpoint detection and response (EDR) tools can help identify and block malicious PDF files.

Public Exploit Available: No (exploit_available: false)

This vulnerability represents a significant risk to user workstations and should be treated with high priority. Organizations must ensure that the automatic update mechanism for Google Chrome is functional or push the required version update across all managed endpoints to mitigate the potential for remote code execution.