An unauthenticated remote attacker can execute arbitrary code on systems running vulnerable versions of Google Chrome via a crafted HTML page by exploiting a use after free flaw in WebAudio.

This vulnerability is a use after free memory corruption flaw (CWE-416) within the WebAudio component. An unauthenticated attacker requiring user interaction can trigger the flaw by enticing a user to visit a malicious HTML page.

A successful exploit of this vulnerability can lead to complete system compromise, allowing an attacker to execute arbitrary code within the browser sandbox. This creates significant risks for data confidentiality, integrity, and availability, potentially exposing enterprise networks to malware deployment or secondary attacks. Although the CVSS score is 8.8, indicating high severity, user interaction is required to trigger the attack vector.

Immediate Action: Update Google Chrome to version 148.0.7778.96 or later by applying the vendor security update immediately.

Proactive Monitoring: Monitor endpoint telemetry for anomalous browser subprocess crashes, unexpected child process spawning, or unusual outbound network connections originating from browser endpoints.

Compensating Controls: Utilize browser security extensions and endpoint detection and response tools to monitor for unauthorized script execution and restrict users from visiting untrusted websites.

Public Exploit Available: No (no confirmed public exploit in available data)

This vulnerability poses a severe threat to endpoint security due to the capability for remote code execution through standard web browsing. Administrators must prioritize updating all instances of Google Chrome across the organization to eliminate the use after free condition and prevent potential exploitation.