Google Chrome versions prior to 148.0.7778.216 contain a heap buffer overflow vulnerability that could lead to arbitrary code execution.

This is a heap buffer overflow (CWE-122) in the WebCodecs component. The vulnerability is triggered via user interaction (e.g., visiting a malicious site) and does not require prior authentication.

Successful exploitation of this heap buffer overflow could allow an attacker to execute arbitrary code within the context of the browser. Given the CVSS score of 8.8, this poses a high risk to organizational security, potentially leading to full system compromise, data exfiltration, or the deployment of malware across endpoints.

Immediate Action: Update all instances of Google Chrome to version 148.0.7778.216 or later immediately.

Proactive Monitoring: Monitor browser-related crash logs and endpoint security telemetry for unusual process behaviors or attempts to execute unexpected code within the Chrome sandbox.

Compensating Controls: Ensure that endpoint protection software is active and updated to detect known exploit patterns; restrict browser capabilities via GPO where possible in highly sensitive environments.

Public Exploit Available: No

Due to the high CVSS score and the nature of heap corruption vulnerabilities, this issue presents a significant threat to browser security. Administrators should prioritize the deployment of the latest Google Chrome update across the enterprise to mitigate the risk of remote code execution.