A critical vulnerability in Google Chrome for Android enables sandbox escape and arbitrary code execution, posing a significant risk to user data and device integrity.

The flaw involves an externally controlled reference within the WebView component (CWE-610). An unauthenticated remote attacker can leverage this issue to escape the browser sandbox and execute arbitrary code, provided they have already compromised the renderer process.

Successful exploitation allows an attacker to bypass critical security boundaries, leading to potential unauthorized access to sensitive user data, installation of malware, or full device compromise. While the CVSS score is 8.3, the impact is elevated by the potential for cross-site scripting or malicious navigation to trigger code execution, which could result in severe reputational and operational damage for organizations relying on mobile browser security.

Immediate Action: Update the Google Chrome application on all Android devices to version 152.0.7977.65 or later through the Google Play Store.

Proactive Monitoring: Monitor device traffic and application logs for unusual renderer process behavior or unexpected navigation patterns that might indicate an exploitation attempt.

Compensating Controls: Ensure that enterprise mobility management (EMM) policies are enforced to restrict untrusted content and maintain up-to-date security patches across the mobile fleet.

Public Exploit Available: No confirmed public exploit (none).

Given the potential for sandbox escape and arbitrary code execution, this vulnerability represents a significant threat to mobile security. Administrators must prioritize the deployment of the latest Chrome update to all Android endpoints to ensure the vulnerability is remediated and the sandbox environment is properly secured.