A race condition exists in the Actor implementation of Google Chrome prior to 156.0.8078.47. A remote attacker can exploit this flaw by delivering a specially crafted HTML page that, via social engineering, causes the browser to expose cross‑origin data. The vulnerability does not allow code execution but can lead to the disclosure of sensitive information from other origins, representing a confidentiality risk.

Versions of Google Chrome prior to 156.0.8078.47 are vulnerable. The flaw affects all builds that include the affected Actor implementation, so any desktop client relying on the specified version is at risk.

The flaw has a CVSS score of 8.8, indicating high severity, and an EPSS score of less than 1%, showing a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog. While the CVE title references arbitrary code execution inside the sandbox via a crafted HTML page, the official description documents a race condition in the Actor implementation that allows a remote attacker, through social engineering, to trigger a cross‑origin data disclosure. The attack vector is remote; a victim may be lured to a malicious page that activates the race condition, resulting in sensitive information leakage but no confirmed code execution.