The flaw is a race condition in the Toolbar component of Google Chrome on Android versions before 156.0.8078.47. It can be triggered by a maliciously crafted HTML page that a user opens via social engineering. Opening the page activates the race condition, allowing a remote attacker to bypass Chrome’s system access restrictions and potentially elevate privileges or compromise device integrity.

The affected systems are devices running Google Chrome for Android with versions older than 156.0.8078.47. The flaw resides in the toolbar handling of HTML pages and is specific to the Android platform.

The CVSS score of 8.8 classifies the flaw as high severity. EPSS indicates a less than 1% probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. A malicious HTML page is required, implying the user must be tricked into opening it – a social engineering risk. If exploited, the attacker could bypass system access restrictions, potentially running code outside Chrome’s sandbox and gaining elevated privileges, posing a significant risk for devices with affected Chrome versions, especially if adequate user training is lacking.