A high-severity use-after-free vulnerability in Google Chrome could allow an attacker to execute arbitrary code on affected Windows systems via a specially crafted web page.

This is a use-after-free vulnerability (CWE-416) within the Media component. The vulnerability requires user interaction (UI:R), such as enticing a user to visit a malicious site, and affects unauthenticated remote attackers.

The vulnerability carries a CVSS score of 8.8 (High), reflecting the potential for total impact on confidentiality, integrity, and availability. Successful exploitation could lead to full system compromise, data theft, or the installation of persistent malware, posing a significant risk to organizational endpoints.

Immediate Action: Update all Google Chrome instances to version 148.0.7778.216 or later immediately.

Proactive Monitoring: Monitor browser-based traffic and endpoint security logs for unusual process execution or unauthorized network connections originating from the Chrome process.

Compensating Controls: Ensure endpoint detection and response (EDR) solutions are active to identify and block suspicious child processes spawned by the browser.

Public Exploit Available: Unknown

Given the high CVSS score and the prevalence of browser-based exploitation, organizations must prioritize the deployment of the Chrome update. Failure to patch may expose users to browser-based attacks that bypass standard security perimeters.