A critical memory disclosure vulnerability in Google Chrome allows remote attackers to bypass sandbox protections, posing a severe risk to user data confidentiality.

The vulnerability is an off-by-one error (CWE-193) within the DevTools component of Google Chrome. This flaw can be triggered by an unauthenticated remote attacker who leverages social engineering to induce a user to install a malicious extension, granting access to protected sandbox memory.

The ability for an attacker to read memory within the Chrome sandbox environment represents a significant failure of the browser security model. This could lead to the unauthorized exfiltration of sensitive user data, authentication tokens, or session information, resulting in potential account takeover or further compromise of corporate assets. While the Chromium project initially assessed this as low severity, the CVSS 3.1 score of 9.1 reflects the high potential for total impact on confidentiality and integrity, necessitating immediate organizational attention.

Immediate Action: Update all instances of Google Chrome to version 152.0.7977.65 or later immediately to incorporate the vendor-supplied security patch.

Proactive Monitoring: Monitor endpoint environments for the installation of unauthorized or suspicious Chrome extensions, particularly those requested via social engineering campaigns.

Compensating Controls: Implement strict browser management policies through Group Policy or MDM solutions to restrict the installation of extensions from unauthorized sources or the Chrome Web Store.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS score, organizations must prioritize the deployment of the latest Chrome update across all managed workstations. Relying on browser-level sandbox protections is insufficient while this memory disclosure flaw remains unpatched, as it allows attackers to undermine the fundamental security boundaries of the browser.