A high-severity race condition vulnerability in Google Chrome could allow a remote attacker to achieve sandbox escape and arbitrary code execution.

This vulnerability is a race condition in the FileSystem component, which can be leveraged by a remote attacker who has already compromised the renderer process to escape the browser sandbox. The attack requires user interaction via a crafted HTML page and is classified as unauthenticated from the perspective of the browser process.

The ability to escape the browser sandbox and execute arbitrary code poses a severe risk to organizational assets. A successful exploit could lead to full system compromise, unauthorized data exfiltration, or the installation of persistent malware on the host machine. With a CVSS score of 8.3, this vulnerability represents a significant threat to endpoint security and requires immediate remediation.

Immediate Action: Update Google Chrome to version 152.0.7977.65 or later immediately to apply the necessary security patches.

Proactive Monitoring: Review endpoint security logs and browser process activity for anomalous behavior, particularly regarding unexpected file system access or system calls originating from the browser.

Compensating Controls: Ensure that all endpoints are running with modern browser hardening features enabled, such as site isolation, and utilize endpoint detection and response (EDR) solutions to identify and block suspicious child processes spawned by the browser.

Public Exploit Available: No

Given the potential for sandbox escape and subsequent remote code execution, organizations should prioritize updating all instances of Google Chrome. The high CVSS score reflects the significant risk posed by this vulnerability, and failure to patch could leave systems vulnerable to sophisticated browser-based attacks.