Google Chrome prior to version 148.0.7778.96 is vulnerable to a use-after-free flaw in the GPU component, allowing a compromised renderer process to achieve a sandbox escape via a crafted HTML page.

This is a Use After Free vulnerability (CWE-416) within the GPU component. An unauthenticated remote attacker who has compromised the renderer process can trigger the flaw via a crafted HTML page with user interaction required.

A successful exploit of this vulnerability could allow an attacker to escape the browser sandbox, potentially leading to complete system compromise, arbitrary code execution, and a total loss of confidentiality, integrity, and availability on the host machine. Although the CVSS score is 8.3, the potential for total technical impact and sandbox escape poses severe risks to enterprise environments utilizing affected browser versions.

Immediate Action: Update Google Chrome to version 148.0.7778.96 or later as provided by the vendor security advisory.

Proactive Monitoring: Monitor client endpoints for unexpected browser crashes or anomalous process execution following web navigation.

Compensating Controls: Restrict web browsing activities or utilize endpoint security solutions with advanced exploit guard capabilities to detect and block sandbox escape attempts.

Public Exploit Available: No (As of available data, no weaponized exploit or public proof-of-concept has been confirmed).

Organizations must prioritize updating Google Chrome across all managed endpoints to version 148.0.7778.96 or later to eliminate the risk of sandbox escape. Given the severity of browser-based vector exploitation, prompt patch management is critical to maintaining endpoint defense.