Race condition in the V8 JavaScript engine found in Google Chrome before version 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox via a specially crafted HTML page. The engine's unsynchronized access to shared memory enables corruption that can be leveraged to bypass the sandbox, giving the attacker the privileges of the user running Chrome. This remote code execution could lead to full system compromise if the victim acts as a privileged user.

It affects Google Chrome versions prior to 156.0.8078.47. All users running any earlier build are vulnerable. The fix is released in update 156.0.8078.47 and later.

The CVSS score is 8.8, indicating high severity. The EPSS score is <1%, showing a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and relies on delivery of a crafted HTML page that a user opens or is embedded in a website.