A critical use after free vulnerability in Google Chrome allows remote, unauthenticated attackers to execute arbitrary code, posing a significant risk to system integrity.

This is a use after free flaw (CWE-416) within the Chromoting component. It allows a remote, unauthenticated attacker to trigger memory corruption and achieve arbitrary code execution by sending malicious network traffic to the browser.

The ability for an unauthenticated remote attacker to achieve arbitrary code execution represents a critical threat to organizational security. Successful exploitation could lead to full system compromise, the theft of sensitive user data, or the installation of persistent malware, justifying the High CVSS score of 8.1.

Immediate Action: Update Google Chrome to version 147.0.7727.138 or later immediately to incorporate the security fix.

Proactive Monitoring: Monitor network traffic for unusual patterns directed at browser services and review system logs for signs of anomalous process behavior.

Compensating Controls: Ensure that endpoint protection software is active and configured to block known malicious payloads, and restrict browser access to untrusted network segments where possible.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability poses a severe risk to any environment relying on Google Chrome. Organizations must prioritize the deployment of the vendor-supplied update across all workstations to mitigate the risk of exploitation.