A high-severity use after free vulnerability in Google Chrome on Windows allows unauthenticated remote attackers to achieve arbitrary code execution.

This is a use after free vulnerability (CWE-416) located within the Chromoting component. The flaw allows an unauthenticated remote attacker to trigger memory corruption and execute arbitrary code outside the browser sandbox by sending specifically crafted network traffic to a targeted system.

The ability for a remote attacker to execute arbitrary code outside the browser sandbox poses a significant threat to organizational security. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the installation of persistent malware, justifying the CVSS score of 8.1.

Immediate Action: Update Google Chrome to version 152.0.7977.65 or later immediately to resolve the vulnerable memory management state.

Proactive Monitoring: Review network traffic logs for anomalous patterns directed at Chromoting endpoints and monitor endpoint detection systems for suspicious child processes spawning from the browser.

Compensating Controls: Utilize endpoint security software with robust exploit prevention capabilities to detect and block memory corruption attempts at the host level while the patch is being deployed.

Public Exploit Available: Unknown

Given the potential for remote code execution, this vulnerability represents a significant risk to workstations running Google Chrome on Windows. IT administrators should prioritize the deployment of the 152.0.7977.65 update across all managed Windows endpoints to ensure the vulnerability is neutralized.