A critical local privilege escalation flaw in Google Chrome for Windows allows an attacker to escape the sandbox and execute arbitrary code on the host system.

This vulnerability is classified as CWE-59: Link following. It occurs within the CredentialProvider and allows an unauthenticated local attacker to escape the browser sandbox and execute arbitrary code via a local program.

The ability to escape the browser sandbox and execute arbitrary code poses a severe threat to system integrity and data confidentiality. With a CVSS score of 8.4, this high-severity vulnerability could allow an attacker to gain full control over the affected workstation, potentially leading to the theft of sensitive credentials or the deployment of persistent malware.

Immediate Action: Update Google Chrome on all Windows systems to version 151.0.7922.169 or later.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected access to system files by the browser process.

Compensating Controls: Ensure that local users operate with the principle of least privilege to limit the impact of code execution should a compromise occur.

Public Exploit Available: False

Given the severity of potential sandbox escapes, organizations should prioritize the deployment of the 151.0.7922.169 update across all Windows endpoints. Failure to patch allows a local attacker to bypass core security boundaries, significantly increasing the risk of full system compromise.