Race condition in the Sensor component of Google Chrome versions prior to 156.0.8078.47 allows a remote attacker, after compromising the renderer process, to potentially execute arbitrary code outside the sandbox through a crafted HTML page. The flaw is a classic concurrency flaw (CWE‑362) that can be triggered by timing differences in shared state access.

Google Chrome versions before 156.0.8078.47 are impacted. Users must upgrade to this version or newer to remove the vulnerability.

The CVSS score of 8.8 reflects high severity. The EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires a malicious website that first compromises the renderer process; the attacker then triggers the race condition in the Sensor component to escape the sandbox and run code with elevated privileges.