Race condition in the Chrome Core on macOS, before version 155.0.8059.39, allows a remote attacker who has already compromised the renderer process and used social engineering to serve a specially crafted HTML page to potentially execute code outside the browser sandbox. This flaw enables an attacker to gain arbitrary code execution privileges, bypassing the browser's sandbox and threatening the confidentiality, integrity, and availability of the host system. The associated Weakness ID indicates a race condition that undermines process isolation.

Google Chrome on macOS systems running any version prior to 155.0.8059.39 is affected. The vulnerability is not known to impact Windows or Linux builds, and no other vendors are listed.

The vulnerability has a CVSS score of 8.3, indicating high severity, but no EPSS score is available and it has not been listed in the CISA KEV catalog. Exploitation requires a multi‑step approach: the adversary must first compromise the renderer process and then entice a user to load the crafted HTML page. If all prerequisites are met, the attacker could gain arbitrary code execution outside the sandbox. The lack of publicly known exploits and the need for social engineering suggest moderate difficulty, but the high impact warrants immediate attention.