Google Chrome for macOS implements a mechanism called WebAppInstalls to enable installing web applications. In versions prior to 155.0.8059.39, a flaw in reference resolution allows a remote attacker who has already compromised the renderer process to send specially crafted network traffic that results in execution of arbitrary code outside the browser sandbox. The vulnerability directly grants code‑execution capability and therefore carries a severe impact on confidentiality, integrity, and availability of the host system.

Chrome users on macOS running any stable channel version earlier than 155.0.8059.39 are affected. This includes Chrome 155.0.8044.x and earlier releases. The flaw does not impact non‑macOS platforms and is limited to browsers that employ the WebAppInstalls feature.

The CVSS score of 8.3 indicates the vulnerability has a high severity rating, and no EPSS value is available and it is not listed in the CISA KEV catalog. Exploitation requires an attacker to first compromise the renderer process and then drive it into a state where crafted network traffic triggers the incorrect reference resolution. While the attack surface is non‑trivial, successful exploitation results in code execution outside the sandbox, a high‑impact outcome. The lack of publicly available exploitation evidence and EPSS data suggests a lower probability of widespread use, yet the severity warrants prompt mitigation.