A critical use after free vulnerability in Google Chrome allows remote attackers to execute arbitrary code on affected Linux and ChromeOS systems.

This vulnerability is a use after free flaw (CWE-416) within the Canvas component of the browser. It allows an unauthenticated remote attacker to trigger memory corruption and achieve arbitrary code execution within the sandbox by enticing a user to visit a crafted HTML page.

Successful exploitation poses a severe risk to organizational security, as it enables remote code execution on end-user workstations. With a CVSS score of 8.8, this vulnerability carries a high impact on confidentiality, integrity, and availability, potentially leading to full system compromise or the exfiltration of sensitive browser-stored credentials and data.

Immediate Action: Update Google Chrome on all Linux and ChromeOS installations to version 147.0.7727.138 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for signs of unusual browser behavior or crashes associated with the rendering process.

Compensating Controls: Ensure that browser sandbox protections are fully enabled and consider using endpoint detection and response tools to identify anomalous child processes spawned by the browser.

Public Exploit Available: No

Given the capability for remote code execution and the high CVSS severity, this update should be treated as a priority for all affected environments. Administrators must ensure that the patch is deployed across all Linux and ChromeOS endpoints to eliminate the risk of arbitrary code execution stemming from malicious web content.