In Google Chrome for macOS versions earlier than 155.0.8059.79, a flaw in extension reference resolution allows a remote attacker who has already compromised the renderer process to run code outside the browser sandbox, potentially giving full control of the host system. The vulnerability is identified as CWE‑706 and carries a high severity CVSS score of 8.3.

Chrome browsers running on macOS before build 155.0.8059.79 are affected. Earlier releases lack the patch that corrects the reference resolution logic. All newer builds onward contain the fix.

The CVSS score of 8.3 reflects the powerful impact of taking control of the host. However, the EPSS score of less than 1% indicates that exploitation is unlikely at present. The vulnerability requires that the attacker already control the renderer process, typically achieved by executing a malicious or compromised extension. In such a scenario, the attacker can redirect references to arbitrary memory locations, escape the sandbox, and execute code on the machine. Because the vector is limited to compromised extensions, the broad availability of the exploit is constrained, but once successful it is highly damaging.