A high severity use after free vulnerability in Google Chrome prior to version 148.0.7778.96 allows remote code execution via malicious web content.

This is a use after free vulnerability categorized under CWE-416, occurring within the DOM component. An unauthenticated attacker utilizing user interaction, such as luring a victim to a crafted HTML page, can trigger memory corruption and achieve arbitrary code execution inside the browser sandbox.

Successful exploitation of this vulnerability allows a remote attacker to execute arbitrary code within the context of the browser, potentially leading to system compromise, data theft, or installation of malware on the host machine. The CVSS score of 8.8 reflects the high risk of confidentiality, integrity, and availability impacts if an attacker successfully leverages this flaw against end users.

Immediate Action: Update Google Chrome to version 148.0.7778.96 or later immediately.

Proactive Monitoring: Monitor endpoint detection and response telemetry for anomalous browser child process behavior or unexpected crash dumps indicative of exploitation attempts.

Compensating Controls: Ensure endpoint security controls are active and utilize web filtering technologies to block known malicious domains and untrusted or unverified web content.

Public Exploit Available: false / unknown

Organizations and individual users must treat this vulnerability with high urgency given the potential for remote code execution. Administrators should deploy the latest browser updates across all managed endpoints immediately to mitigate the risk of exploitation.