Technical impact
The vulnerability is a use‑after‑free flaw in the Chrome Updater component on macOS that allows a malicious actor to craft network packets that trigger the freed object’s memory to be reused. By exploiting this flaw, the attacker can execute arbitrary native code outside of the regular sandbox, resulting in full system compromise. The weakness is identified as CWE‑416.
Affected Systems
Affected systems include Google Chrome for macOS. Any installation on macOS with Chrome running a version earlier than 154.0.8037.57 is vulnerable. The issue is limited to the Updater module and does not apply to Windows or Linux releases.
Risk and Exploitability
The CVSS score of 9.6 indicates an extremely high severity flaw, giving attackers the possibility to gain arbitrary code execution with little or no privileges. Because the EPSS score is not provided, the current exploit probability cannot be quantified, but the absence of KEV listing indicates no known in‑the‑wild exploitation has been reported yet. The exploitation vector is network-based: a remote attacker can send specially crafted packets to the Chrome Updater component over its update channel. If the victim’s computer is running a vulnerable Chrome version on macOS, the attacker can achieve system‑level compromise.
Debian DSA