The flaw is a race condition in Chrome’s bindings that can be triggered by a crafted HTML page, leading to an out‑of‑bounds write. This may allow an attacker to bypass the browser’s site isolation mechanism, potentially exposing the browsing session to further compromise. The vulnerability is classified as CWE‑362. While the description does not explicitly state remote code execution, the ability to evade isolation is a serious security concern that could enable additional attacks on the user level.

All desktop versions of Google Chrome older than 156.0.8078.47 contain the vulnerable bindings code. Chrome builds of 156.0.8078.47 and later have removed the code path that introduces the race condition. Users running Chrome on any operating system (Windows, macOS, Linux) are affected if their installation is prior to the patched version.

The CVSS score of 8.8 marks this as a high‑severity vulnerability. The EPSS score of < 1 % indicates that exploitation is currently considered very unlikely, and the flaw is not listed in CISA’s KEV catalog. Nevertheless, the attack requires only a crafted HTML page served over the internet, so any user who visits such a page on an unpatched system could be exposed to the risk of site‑isolation bypass and its downstream impacts.