Race condition exists in Chrome extensions prior to version 156.0.8078.47. A remote attacker can trigger the flaw by hosting a malicious web page and using social engineering to lure a user. The crafted HTML payload bypasses system access restrictions. This weakness is classified as CWE-362.

Google Chrome desktop installations, on Windows, macOS and Linux, running any version earlier than 156.0.8078.47, are affected. Users who have not applied the latest update lack the input validation checks introduced in the patched release.

The CVSS score of 8.8 indicates a high severity level. The EPSS score is less than 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no known exploitation to date. The likely attack path requires a remote attacker to host a malicious page that a user visits; social engineering is needed to ensure the user interacts with the payload. Successful exploitation would bypass Chrome’s system access restrictions, potentially enabling sandboxed code execution within the browser or allowing privilege escalation.