Race condition in the font rendering subsystem of Google Chrome, disclosed prior to version 155.0.8059.39, permits a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox. The flaw, classified as a race condition (CWE‑362), allows the attacker to bypass sandbox boundaries through a crafted HTML page and run malicious code with elevated privileges, compromising confidentiality, integrity, and availability of the compromised system.

The vulnerability affects Google Chrome browsers running on desktop platforms. All releases before 155.0.8059.39 may be vulnerable if an attacker can gain control over the renderer process. The latest stable channel update brings the renderer sandbox fixes that neutralize the race condition.

The CVSS score of 8.3 indicates a High severity, and no EPSS data is currently available, which suggests a low publicly known exploitation probability, yet the exploit requires only a crafted HTML page delivered to a compromised renderer. The issue is not listed in the CISA KEV catalog, indicating no known active exploitation at this time. Nonetheless, remote code execution outside the sandbox remains a severe threat if an attacker can deliver the malicious page. Adopting the latest patch and enforcing the renderer sandbox policy mitigates the risk.