A critical use after free vulnerability in Google Chrome allows remote attackers to execute arbitrary code via social engineering, necessitating an immediate browser update.

This is a use after free flaw in the network stack of Google Chrome. It requires no authentication and can be triggered by an unauthenticated attacker who successfully employs social engineering to convince a user to install or interact with a crafted extension.

The vulnerability carries a CVSS score of 9.6, reflecting the potential for a complete compromise of the underlying system. Successful exploitation allows an attacker to escape the browser sandbox and execute arbitrary code, which could lead to unauthorized data access, the installation of persistent malware, or total system takeover.

Immediate Action: Update all instances of Google Chrome on macOS to version 152.0.7977.65 or later immediately.

Proactive Monitoring: Monitor endpoint security logs for unexpected process execution originating from the Chrome browser or its associated extension processes.

Compensating Controls: Enforce organizational policies that restrict the installation of browser extensions to a pre-approved list or disable extension installation entirely via mobile device management (MDM) until updates are applied.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity and the potential for sandbox escape, organizations must prioritize updating Google Chrome across all managed macOS environments. Relying on user discretion to avoid malicious extensions is insufficient, and administrators should automate the deployment of the patch to ensure rapid coverage and minimize the window of exposure.