A high-severity use after free vulnerability in Google Chrome allows remote code execution, posing a significant risk to user systems.

This is a use after free vulnerability (CWE-416) within the Dawn component. It allows a remote, unauthenticated attacker who has compromised the renderer process to execute arbitrary code when a user views a specially crafted HTML page.

The ability for a remote attacker to execute arbitrary code on a user workstation presents a severe risk of system compromise, data theft, and potential lateral movement within the network. Given the CVSS score of 7.5, this vulnerability is classified as High severity, indicating a significant threat to organizational security and endpoint integrity.

Immediate Action: Update all Google Chrome installations to version 146.0.7680.178 or later to resolve the underlying memory management flaw.

Proactive Monitoring: Monitor endpoint logs for unusual child process creation or unexpected crashes within the Chrome browser environment.

Compensating Controls: Ensure that users operate with the least privilege necessary and leverage browser-based security policies to restrict the execution of untrusted or malicious scripts.

Public Exploit Available: Unknown

The vulnerability represents a critical risk to endpoint security due to the potential for arbitrary code execution. Security teams should prioritize the deployment of the browser update across all managed assets to prevent exploitation. Maintaining an up-to-date browser version is the most effective defense against this and similar memory-related vulnerabilities.