A use after free vulnerability in Google Chrome allows local attackers to escape the browser sandbox and execute arbitrary code, posing a significant risk to endpoint integrity.

This is a use after free vulnerability (CWE-416) occurring within the user interface component of Google Chrome. The vulnerability requires a local attacker to first compromise the renderer process, after which they can leverage this flaw to execute code outside the browser sandbox.

Successful exploitation of this vulnerability permits a local attacker to bypass the browser sandbox, which is a critical security boundary. This could lead to full system compromise, unauthorized data access, or the deployment of persistent malware on the host machine. While the CVSS score of 7.7 reflects a high severity, the ability to achieve arbitrary code execution via sandbox escape necessitates immediate patching to maintain the security posture of organizational endpoints.

Immediate Action: Update Google Chrome to version 152.0.7977.65 or later to resolve the underlying memory management flaw.

Proactive Monitoring: Monitor endpoint security logs for unexpected process spawns originating from the browser or unauthorized attempts to access sensitive local system files.

Compensating Controls: Ensure that endpoint protection platforms and antivirus software are fully updated to detect post exploitation activity or sandbox escape attempts.

Public Exploit Available: No

Given the potential for sandbox escape and subsequent arbitrary code execution, this vulnerability should be prioritized for remediation across all managed workstations. Administrators should verify that the automated update mechanism is functioning correctly and push the update to 152.0.7977.65 immediately to eliminate this attack vector.