A critical race condition in the Google Chrome GPU component allows remote attackers to escape the sandbox and execute arbitrary code, posing a severe risk to system integrity.

This vulnerability is a race condition (CWE-367) occurring within the GPU process. An unauthenticated remote attacker can trigger this flaw by enticing a user to navigate to a crafted HTML page, provided the attacker has already compromised the browser renderer process.

The ability to execute arbitrary code outside the browser sandbox allows an attacker to bypass critical security boundaries, potentially leading to full system compromise, data exfiltration, or the installation of persistent malware. Although the CVSS score is 8.3, which indicates a High severity, the impact on Confidentiality, Integrity, and Availability is categorized as total, necessitating immediate attention to prevent potential business disruption and unauthorized access to sensitive internal resources.

Immediate Action: Update all instances of Google Chrome to version 152.0.7977.65 or later to apply the necessary security patches.

Proactive Monitoring: Monitor endpoint logs for unusual child process creation or unauthorized file system access originating from the Chrome browser process.

Compensating Controls: While no direct virtual patch exists, maintaining browser security policies that restrict navigation to untrusted sites and utilizing robust endpoint detection and response (EDR) solutions can help mitigate the risk of post-exploitation activity.

Public Exploit Available: No (exploit_available: false)

Given the potential for sandbox escape and arbitrary code execution, this vulnerability represents a significant threat to organizational endpoints. IT administrators should prioritize the deployment of the 152.0.7977.65 update across all managed environments immediately. Regular patching cycles are essential to close these high-impact browser vulnerabilities before they can be weaponized by external adversaries.