A critical vulnerability in Google Chrome for Mac allows unauthenticated remote attackers to achieve arbitrary code execution outside the browser sandbox via specially crafted HTML content.

This flaw stems from improper quantity validation within the Tint component of the browser. An unauthenticated attacker can exploit this via a malicious HTML page, triggering memory corruption that leads to code execution outside the browser security sandbox.

Successful exploitation of this vulnerability poses a severe threat to organizational security, as it allows attackers to bypass the browser sandbox and potentially gain full control over the host system. Given the CVSS score of 9.6, this is classified as a critical risk that could lead to data exfiltration, installation of persistent malware, or complete system compromise. The ability for an unauthenticated attacker to trigger this via a simple web page visit makes it a high-priority target for exploit development.

Immediate Action: Update Google Chrome on all affected Mac systems to version 153.0.8010.36 or higher immediately.

Proactive Monitoring: Monitor endpoint detection logs for unexpected process execution or abnormal child processes spawned by the Google Chrome application.

Compensating Controls: Ensure that Endpoint Detection and Response (EDR) solutions are active and configured to alert on unauthorized attempts to escape the browser sandbox or execute unauthorized binaries.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate action, as it provides a direct path for remote code execution on end-user workstations. Security teams should prioritize the deployment of the 153.0.8010.36 update across the enterprise to eliminate this critical attack vector. Failure to patch these systems leaves the organization vulnerable to high-impact remote exploitation.