A use after free vulnerability in Google Chrome prior to version 148.0.7778.96 allows unauthenticated remote attackers to achieve arbitrary code execution via crafted HTML pages.

This flaw is a use after free (CWE-416) vulnerability within the CSS implementation of Google Chrome, triggered by an unauthenticated remote attacker via a crafted HTML page requiring user interaction.

A successful exploit can lead to complete system compromise, allowing an attacker to execute arbitrary code within the browser sandbox, potentially leading to unauthorized access, data theft, or further internal network propagation. The CVSS score of 8.8 reflects the high severity of potential impacts, including complete confidentiality, integrity, and availability compromise upon successful exploitation.

Immediate Action: Update Google Chrome to version 148.0.7778.96 or later immediately.

Proactive Monitoring: Monitor endpoint telemetry for anomalous browser crash patterns, unexpected child process spawning, or unusual outbound network traffic from affected workstations.

Compensating Controls: Enforce strict browsing policies, utilize modern endpoint detection and response (EDR) solutions, and employ web filtering mechanisms to block access to untrusted or malicious domains.

Public Exploit Available: Unknown

This high-severity vulnerability poses a substantial risk of remote code execution through standard web browsing vectors. IT administrators and security teams must prioritize updating Google Chrome across all endpoints to the fixed version immediately to mitigate potential exploitation.