Race condition in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The flaw is a CWE‑367 race condition issue, and its exploitation can lead to arbitrary code execution outside the sandbox, potentially compromising the system without user interaction beyond visiting a malicious page.

Google Chrome versions earlier than 156.0.8078.47 on any platform are affected, regardless of operating system or device type.

The vulnerability scores 9.6 on the CVSS scale, indicating a critical risk. The EPSS score is less than 1 %, and it is not listed in the CISA KEV catalog; however, these factors do not diminish the inherent danger. An attacker can deliver the malicious HTML over the network to trigger the exploit once the renderer process has been compromised. Given the high severity and the nature of the flaw, the risk of exploitation is significant unless mitigated promptly.