A race condition in Chrome’s WebProtect component can be exploited by a remote attacker who already has control over the renderer process. When a specially crafted PDF is processed, the race condition allows the renderer to break out of its sandboxed environment and bypass the browser’s system‑access restrictions, potentially granting the attacker elevated privileges on the host operating system. The flaw is classified as CWE‑367.

Any installation of Google Chrome earlier than version 156.0.8078.47 is affected. This includes users on the stable channel and any other channel that has not received the latest update package containing the WebProtect fix.

The CVSS base score of 8.8 marks the vulnerability as high severity. The EPSS score of <1% indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a multi‑stage attack: first, the renderer process must be compromised; second, the victim must be persuaded to open a malicious PDF. While the prerequisites reduce the chances of widespread attacks, the potential for privilege escalation warrants prompt remediation.