Use-after-free in Google Chrome GPU leading to sandbox escape

Successful exploitation can allow an attacker who already has code execution or equivalent control within the renderer process to break out of the renderer sandbox. This can defeat a major browser security boundary and enable broader compromise of the browser process or host context, potentially facilitating arbitrary code execution, privilege escalation within the browser architecture, access to sensitive data available outside the renderer sandbox, and follow-on actions depending on the privileges of the logged-on user.

If immediate patching is not possible, reduce exposure by limiting the ability to reach attacker-controlled web content, enforcing least privilege for end users, maintaining Chrome sandboxing and OS exploit protections, restricting unnecessary browser capabilities and high-risk features where feasible, and auditing/removing untrusted or overly privileged extensions. Additional defensive measures from the provided context include DNS/URL filtering, blocking unnecessary file types, and monitoring exploit intelligence during the period immediately following patch release. These measures do not remove the vulnerability and should only be treated as temporary risk reduction until the browser is updated.

Upgrade Google Chrome to version 150.0.7871.47 or later. The provided advisory context also notes fixed versions of 150.0.7871.46/47 or later for Windows and macOS and 150.0.7871.46 or later for Linux in the broader Chrome release, but for this specific CVE the cited fix threshold is prior to 150.0.7871.47. Enterprises should prioritize rollout of the latest stable Chrome release across managed fleets and ensure downstream Chromium-based browsers are updated as vendor fixes become available.