A high-severity use-after-free vulnerability in Google Chrome WebGPU allows remote attackers to execute arbitrary code, posing a significant risk to user systems.

This is a use-after-free flaw (CWE-416) within the WebGPU component. The vulnerability can be triggered by a remote, unauthenticated attacker who lures a user to a specially crafted HTML page.

The vulnerability carries a CVSS score of 8.8, indicating a high risk to organizational security. Successful exploitation allows for arbitrary code execution, which could lead to full system compromise, data theft, or the installation of malicious software. Given the ubiquitous nature of web browsers in enterprise environments, this flaw represents a critical vector for lateral movement and endpoint compromise.

Immediate Action: Update all Google Chrome installations to version 146.0.7680.165 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for unexpected process crashes or unauthorized execution attempts associated with the Chrome browser process.

Compensating Controls: Ensure that browser-based security policies are enforced and consider using endpoint detection and response (EDR) solutions to identify and block suspicious child processes spawned by browser applications.

Public Exploit Available: No — exploit_available (unknown).

This vulnerability is serious and requires immediate attention due to the ease of delivery via malicious web content. Organizations should prioritize the deployment of the Chrome update to all managed endpoints to mitigate the risk of arbitrary code execution. Continuous browser maintenance is essential for maintaining a secure security posture against browser-based threats.