Chromoting, a Chrome feature, contained a race condition that permits a remote attacker to send specially crafted network packets and potentially bypass system access restrictions, which could result in privilege escalation. The flaw is a classic race condition (CWE‑362). This weakness allows state changes during execution to be manipulated by external traffic, enabling unintended behavior. The impact is that a remote attacker who can influence the packet stream may gain elevated capabilities on the target system.

Google Chrome browsers up to and including version 155.0.8059.39 are affected. Versions newer than 155.0.8059.39 contain the fix. Only the stable channel of Chrome is known to be impacted.

The CVSS score is 5.3, which is considered medium-low. The vulnerability has a low Chromium severity rating, indicating that exploitation is not trivial. The EPSS score is < 1% and the flaw is not listed in CISA’s KEV catalog, suggesting limited known exploitation. However, the exploit requires remote delivery of crafted network traffic, which typically relies on social engineering or compromised networks. While the success probability is uncertain, any exposed system running the affected Chrome version remains at risk of privilege escalation if an attacker can gain network access.