The CVE describes a race condition inside the Transactions Platform component of Google Chrome. The flaw is a use‑after‑free bug (CWE‑367) combined with improper resource handling (CWE‑825). A remote attacker who has already compromised the renderer process can trigger the race condition with a crafted HTML page, causing the browser to spoof UI elements. This can be leveraged for social‑engineering attacks because the forged interface may appear legitimate to the user.

Google Chrome on all platforms that run a release prior to version 156.0.8078.47 is affected. The issue is confined to the stable channel updates for desktop versions.

The CVSS score of 8.8 classifies the vulnerability as high severity, though Chromium security notes it as Medium because the attacker must first escape the renderer sandbox. The EPSS score is reported as less than 1 %, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack requires remote access to a compromised renderer process and is exploited via a crafted HTML page that triggers the race condition, potentially allowing UI spoofing but not arbitrary code execution.