A heap buffer overflow vulnerability in Google Chrome on macOS allows unauthenticated remote attackers to achieve arbitrary code execution through malicious web content.

This vulnerability is a heap buffer overflow (CWE-122) located in the ANGLE graphics engine component. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a specially crafted HTML page, potentially leading to full system compromise.

The ability for a remote attacker to execute arbitrary code poses a severe risk to organizational security. Successful exploitation could result in full system compromise, unauthorized data access, or the deployment of malware. With a CVSS score of 8.8, this high-severity vulnerability requires immediate attention to prevent potential data breaches and service disruption.

Immediate Action: Update Google Chrome to version 146.0.7680.178 or later across all managed macOS endpoints.

Proactive Monitoring: Review endpoint security logs for unexpected process execution or abnormal crashes within the browser environment.

Compensating Controls: Ensure that browser-based security features, such as site isolation and sandboxing, are enabled and enforced via organizational policy.

Public Exploit Available: Unknown

Given the high CVSS severity and the potential for remote code execution, this vulnerability represents a significant risk to macOS workstations. Administrators should prioritize the deployment of the browser update to all affected systems immediately. Failure to remediate this flaw exposes the organization to potential exploitation via malicious web-based content.