A race condition exists in the fonts handling subsystem of Google Chrome, which can be triggered by a crafted HTML page. If an attacker has already compromised the renderer process, the timing flaw allows the malicious page to read or write memory beyond its intended bounds, providing a route to execute arbitrary code outside the renderer sandbox. The description indicates that remote exploitation is possible once the renderer is compromised, making the impact severe.

This vulnerability impacts Google Chrome for all platform builds released before version 155.0.8059.39. The affected component is the Fonts module used by the renderer process. Because the advisory references all releases prior to the patched version, it is inferred that every earlier Chrome release is vulnerable, though the statement is not explicitly verified for each individual build.

The CVSS score of 8.3 signals high severity, meaning that successful exploitation could grant significant privileges. The EPSS score is unavailable, so the current likelihood of exploitation is unknown. This flaw is not listed in CISA's KEV catalog. Exploitation requires a prior compromise of the renderer process, which is uncommon on a correctly sandboxed system; however, once that condition is met, a crafted page can trigger the race to escape the sandbox.