Race condition in DevTools that exists in Google Chrome versions prior to 156.0.8078.47 (CWE-367) allows a remote attacker who has compromised the renderer process to potentially bypass site isolation into a privileged page through a crafted HTML page. The vulnerability is triggered by a specially crafted web page that exploits timing differences during rendering, giving the attacker temporary access to higher-isolation contexts. Exploitation could compromise the confidentiality and integrity of data within privileged browsing sessions.

Affected product is Google Chrome for desktop. The vulnerability applies to all installations of Chrome older than version 156.0.8078.47. No further version granularity is provided beyond the stated cutoff.

With a CVSS score of 8.8, the risk of exploitation is significant for users who open malicious or maliciously crafted web pages. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploit at this time. The attack vector is remote; an attacker must deliver a crafted HTML page that triggers the race condition in DevTools, allowing the attacker to bypass site isolation and execute arbitrary code in a privileged page.