A critical integer overflow vulnerability in Google Chrome WebRTC allows remote attackers to execute arbitrary code or cause system crashes through malicious HTML content.

This vulnerability is an integer overflow (CWE-472) occurring within the WebRTC component, which can be leveraged by an unauthenticated remote attacker to perform an out of bounds memory write. The attack requires user interaction, typically involving the victim visiting a specially crafted web page.

The ability to perform an out of bounds memory write through a browser component poses a significant risk to organizational security. Successful exploitation could lead to arbitrary code execution, resulting in full system compromise, loss of sensitive data, or unauthorized access to corporate resources. With a CVSS score of 8.8, this flaw represents a high risk that requires immediate attention to prevent potential weaponization.

Immediate Action: Update Google Chrome to version 147.0.7727.55 or later across all managed endpoints to incorporate the necessary security patches.

Proactive Monitoring: Monitor browser-related crash logs and security event telemetry for patterns indicative of memory corruption or unusual heap spraying attempts.

Compensating Controls: Deploy endpoint protection platforms capable of detecting browser-based exploits and ensure that browser security settings are configured to block suspicious scripts or unauthorized WebRTC usage where possible.

Public Exploit Available: Unknown

Given the potential for remote code execution via browser-based attacks, organizations must prioritize the deployment of the Chrome update. Administrators should verify that all instances of the browser are updated to the patched version immediately to mitigate the risk of memory corruption exploits.