A critical integer overflow vulnerability in Google Chrome on Android enables unauthenticated remote attackers to execute arbitrary code by enticing a user to visit a malicious webpage.

The flaw is an integer overflow (CWE-190) within the GPU process, which can be triggered by an unauthenticated remote attacker through a crafted HTML page. Successful exploitation allows the attacker to bypass sandbox protections and execute arbitrary code on the underlying device.

The ability to execute arbitrary code outside the browser sandbox poses a severe risk to organizational data and device integrity. Given the CVSS score of 9.6, this vulnerability is classified as critical, as it could lead to full device compromise, unauthorized access to sensitive user information, and potential lateral movement within a corporate network.

Immediate Action: Update the Google Chrome application on all Android devices to version 153.0.8010.36 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Security teams should monitor mobile device management (MDM) logs to identify devices running outdated browser versions and review network traffic for suspicious redirects or malicious script patterns commonly used in browser-based attacks.

Compensating Controls: While browser-level patches are the primary defense, ensure that mobile security solutions and endpoint detection and response (EDR) agents are active to detect anomalous process execution originating from the browser.

Public Exploit Available: Unknown

This vulnerability represents a significant risk to mobile security due to the potential for sandbox escape and arbitrary code execution. Organizations must prioritize the deployment of the latest Chrome update across their mobile fleet to remediate this critical flaw and prevent potential exploitation.