A critical vulnerability in Google Chrome allows unauthenticated remote attackers to execute arbitrary code outside the browser sandbox, posing a severe risk to system integrity.

The vulnerability involves incorrect authorization within the FileSystem component of Google Chrome. This flaw allows an unauthenticated remote attacker, requiring user interaction via social engineering, to escape the browser sandbox and execute arbitrary code on the underlying host.

The ability to execute arbitrary code outside the browser sandbox presents a catastrophic risk to organizational endpoints. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, and the installation of persistent malware, effectively bypassing standard browser-based security protections. Given the CVSS score of 9.6, this vulnerability is categorized as critical and demands immediate attention to prevent potential system-wide security breaches.

Immediate Action: Update all instances of Google Chrome to version 152.0.7977.75 or later immediately to apply the necessary authorization fixes.

Proactive Monitoring: Monitor endpoint security logs for unusual process execution patterns or unexpected file system modifications initiated by the browser process.

Compensating Controls: Implement browser-based security policies that restrict the execution of untrusted scripts and utilize endpoint detection and response (EDR) solutions to identify and block sandbox escape attempts.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

This vulnerability represents a significant security risk due to the potential for arbitrary code execution outside the browser sandbox. IT administrators should prioritize the deployment of the vendor-provided update across all managed environments to eliminate this exposure. Failure to patch may leave systems vulnerable to sophisticated attacks that leverage browser-based entry points to gain broader host-level access.