A critical heap corruption vulnerability in Google Chrome allows remote attackers to achieve arbitrary code execution via malicious web content.

This is an out of bounds read and write vulnerability in the WebAudio component. It is an unauthenticated, remote vulnerability that requires user interaction, such as visiting a specially crafted webpage, to trigger heap corruption.

The vulnerability carries a CVSS score of 8.8, indicating a high severity risk. Successful exploitation could allow a remote attacker to execute arbitrary code within the context of the browser, potentially leading to unauthorized system access, data theft, or complete compromise of the user's workstation.

Immediate Action: Update all Google Chrome instances to version 146.0.7680.153 or later immediately to apply the security patch.

Proactive Monitoring: Monitor network traffic for unusual browser activity and review endpoint security logs for signs of anomalous process execution associated with the Chrome browser.

Compensating Controls: Ensure that endpoint protection software is active and updated to detect malicious code execution patterns. Users should exercise caution and avoid clicking on untrusted links or visiting suspicious websites while the patch is being deployed.

Public Exploit Available: Unknown

Given the high CVSS score and the nature of the vulnerability in a widely used web browser, organizations must prioritize the rapid deployment of the latest Chrome security updates. Failure to patch leaves endpoints vulnerable to remote code execution attacks triggered by simple web browsing.