A high-severity double free vulnerability in Google Chrome for Windows allows unauthenticated remote attackers to achieve arbitrary code execution through crafted PDF documents.

This flaw is a double free memory corruption vulnerability (CWE-415) residing in the PDFium library. An unauthenticated remote attacker can trigger this condition by enticing a user to open a specially crafted PDF file, potentially leading to code execution within the browser sandbox.

Successful exploitation of this vulnerability poses a severe risk to organizational endpoints, as it allows for arbitrary code execution. Given the CVSS score of 8.8, this flaw represents a significant threat to confidentiality, integrity, and availability. Compromised browsers may serve as an entry point for lateral movement or the deployment of additional malware within the corporate network.

Immediate Action: Update Google Chrome to version 153.0.8010.36 or later across all Windows workstations immediately.

Proactive Monitoring: Monitor endpoint logs for unusual browser crashes or unexpected child process spawning associated with the Chrome PDFium renderer.

Compensating Controls: Deploy endpoint protection solutions that include exploit prevention features to detect memory corruption attempts, and consider restricting the opening of untrusted PDF files.

Public Exploit Available: No (unknown)

This vulnerability presents a high risk due to the potential for remote code execution via common user interaction. IT administrators must prioritize the deployment of the provided security update to ensure all Chrome instances are running version 153.0.8010.36 or newer. Timely patching is the most effective defense against this class of memory-based attacks.