The vulnerability is a race condition in Chrome Extensions that allows a remote attacker, through social engineering and a crafted HTML page, to bypass system access restrictions. This flaw, which falls under CWE-367, enables the attacker to obtain privileges beyond the normal browser sandbox, potentially compromising data or enabling privileged actions within the browser environment.

Google Chrome versions prior to 156.0.8078.47 are affected. Users running any earlier stable channel build of Chrome are at risk until they upgrade to the patched release.

The CVSS score of 8.8 indicates high severity, but the EPSS score is under 1%, suggesting low current exploit probability. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is a remote web-based exploit where an attacker serves a malicious HTML page to a user. By exploiting the race condition, the attacker can bypass system access restrictions, potentially elevating privileges within the browser or gaining access to restricted resources.