Data race in audio in Google Chrome

Successful exploitation could allow an attacker to induce heap corruption in the browser process. Depending on exploit reliability and surrounding mitigations, this could plausibly lead to browser process compromise, including remote code execution in the context of the targeted user, or at minimum a browser crash/instability condition. The supplied content specifically states that Candiru exploited this Chrome zero-day via single-use links sent to targets believed to be in Armenia, indicating the vulnerability was considered exploitable in real-world targeted operations.

Until patching is completed, reduce exposure by restricting use of untrusted links and web content, especially in high-risk targeted environments; isolate browser activity through sandboxing and endpoint controls; and monitor for suspicious single-use or highly targeted phishing links. Enterprise defenders should prioritize rapid browser patching and consider additional controls such as application isolation and exploit detection for browser memory-corruption activity. Specific temporary vendor mitigations beyond updating were not provided in the supplied content.

Upgrade Google Chrome to version 89.0.4389.72 or later, as the vulnerability affects Chrome prior to 89.0.4389.72. Apply the corresponding Chromium-based browser updates where applicable to ensure the patched code is deployed.