A critical use-after-free vulnerability in Google Chrome for Mac could allow a remote attacker to achieve arbitrary code execution outside the browser sandbox.

This is a use-after-free vulnerability (CWE-416) within the Payments component of the browser. It allows an unauthenticated remote attacker to gain control by enticing a user to navigate to a specifically crafted HTML page.

The ability to execute arbitrary code outside the browser sandbox poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the installation of persistent malware. Given the CVSS score of 9.6, this vulnerability represents a critical threat that must be addressed immediately to prevent potential host-level exploitation.

Immediate Action: Update Google Chrome to version 153.0.8010.36 or later immediately across all managed Mac endpoints.

Proactive Monitoring: Review endpoint security logs for unusual browser activity or unexpected process execution patterns originating from the Chrome application.

Compensating Controls: Ensure that endpoint detection and response tools are active to monitor for abnormal child processes spawned by the browser, which may indicate exploit attempts.

Public Exploit Available: Unknown

The severity of this flaw cannot be overstated, as it bypasses critical browser security boundaries. Administrators must prioritize the deployment of the 153.0.8010.36 update to all Mac users to mitigate the risk of remote code execution and potential system-wide compromise.