A critical use after free vulnerability in Google Chrome allows unauthenticated remote attackers to achieve arbitrary code execution through crafted web content.

This is a use after free vulnerability (CWE-416) within the WebAppInstalls component. An unauthenticated remote attacker can trigger this flaw by enticing a user to visit a malicious HTML page, leading to sandbox escape and arbitrary code execution.

The ability for an attacker to execute arbitrary code outside the browser sandbox poses a severe risk to organizational security. Successful exploitation could lead to full system compromise, unauthorized data exfiltration, or the installation of persistent malware on user workstations. Given the CVSS score of 9.6, this vulnerability is classified as critical due to the potential for total impact on confidentiality, integrity, and availability.

Immediate Action: Update all Google Chrome installations to version 153.0.8010.47 or later immediately to incorporate the necessary memory management fixes.

Proactive Monitoring: Monitor endpoint detection and response logs for anomalous process spawning or suspicious network traffic originating from the browser process.

Compensating Controls: While no direct virtual patch exists for use after free flaws, utilizing browser-based security policies and disabling unnecessary web app features may reduce the attack surface.

Public Exploit Available: No (exploit_available: false)

The severity of this vulnerability necessitates immediate attention from IT and security teams. Because this flaw allows for code execution outside the security boundary of the browser, administrators must prioritize the deployment of the latest Chrome update across all managed devices to mitigate the risk of remote compromise.