A high-severity authorization vulnerability in Google Chrome on Windows permits local attackers to achieve arbitrary code execution outside the browser sandbox.

This flaw, categorized as improper authorization (CWE-863), resides within the Chromoting component. It allows a local, unauthenticated attacker to bypass sandbox protections and execute arbitrary code via a local program.

The ability to execute code outside the Chrome sandbox represents a significant security breach, as it grants an attacker control over the underlying Windows host system. Given the CVSS score of 8.1, this vulnerability poses a high risk to organizational data integrity, confidentiality, and system availability. Successful exploitation could lead to full system compromise, lateral movement within the network, and potential exfiltration of sensitive information stored on the affected workstation.

Immediate Action: Update Google Chrome to version 152.0.7977.75 or later immediately to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for unauthorized execution of programs or suspicious activity originating from the Chromoting component or unexpected local processes.

Compensating Controls: Ensure that endpoint protection software is configured to block unauthorized local program execution and restrict non-administrative users from installing or running untrusted binaries.

Public Exploit Available: No confirmed public exploit is available.

Due to the high severity of this sandbox escape vulnerability, organizations must prioritize updating all Google Chrome installations on Windows systems to the patched version. Failure to update leaves endpoints susceptible to privilege escalation and full system compromise by local attackers. Immediate deployment of the provided update is the most effective method to eliminate this risk.