A use-after-free vulnerability in Google Chrome WebRTC allows remote attackers to execute arbitrary code via crafted HTML pages.

This is a use-after-free memory corruption flaw (CWE-416) within the WebRTC component, triggered when an unauthenticated user visits a crafted HTML page requiring user interaction.

A successful exploit could allow a remote attacker to execute arbitrary code within the browser sandbox, potentially leading to system compromise, data theft, or malware installation on the host machine. Although the CVSS base score is 8.8 (High), the total technical impact on confidentiality, integrity, and availability justifies urgent remediation to protect corporate endpoints.

Immediate Action: Update Google Chrome to version 148.0.7778.96 or later across all managed endpoints.

Proactive Monitoring: Monitor endpoint detection and response (EDR) telemetry for unusual browser child process behavior or unexpected crash dumps associated with WebRTC.

Compensating Controls: Ensure browser security settings are strictly enforced, and encourage users to exercise caution when opening untrusted links or web pages.

Public Exploit Available: false

This vulnerability presents a significant risk to user endpoints due to the potential for remote code execution via standard web browsing. Security teams must ensure that automatic browser updates are enabled and rapidly deploy the patched version across all organizational workstations to mitigate potential exposure.