A critical use after free vulnerability in Google Chrome allows unauthenticated remote attackers to execute arbitrary code on affected systems.

This is a use after free vulnerability (CWE-416) within the Media component that can be triggered by an unauthenticated remote attacker through a crafted HTML page. The vulnerability allows for arbitrary code execution within the browser sandbox.

The vulnerability carries a CVSS score of 8.8, indicating a high level of severity due to its potential for remote code execution. A successful exploit could lead to full system compromise, data theft, or the installation of malicious software, posing a significant threat to organizational assets and user privacy.

Immediate Action: Update Google Chrome to version 147.0.7727.138 or later immediately to resolve the use after free flaw.

Proactive Monitoring: Monitor network traffic for unusual outbound connections from browser processes and review system logs for signs of suspicious browser-based activity.

Compensating Controls: Ensure that users are operating with restricted privileges and utilize modern endpoint protection solutions to detect and block malicious code execution attempts.

Public Exploit Available: No (Exploit_available: false)

Given the potential for remote code execution and the high CVSS severity, organizations should prioritize the deployment of the latest Google Chrome security updates across all managed endpoints. Failure to apply this patch leaves systems vulnerable to browser-based attacks that require minimal user interaction to trigger.