Race condition in the DataTransfer API of earlier versions of Google Chrome permits a remote attacker with control over the renderer process and the ability to perform social engineering to bypass site isolation to trigger a use‑after‑free through a crafted HTML page. If exploited, the attacker can achieve arbitrary code execution inside the browser process, potentially breaking the sandbox boundary. Chromium rates the flaw as medium severity.

Google Chrome versions earlier than 156.0.8078.47 on all supported platforms are affected. This includes stable channel releases prior to the 156.0.8078.47 update and any built‑in Chrome installations that have not yet applied the patch.

The CVSS score of 8.8 indicates a high‑severity flaw with a significant impact. The EPSS score is < 1%, suggesting a very low probability of exploitation, though certain threat actors may still target it. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker delivering a malicious HTML page that uses the DataTransfer API to trigger the use‑after‑free. No public exploit has been documented; however, the combination of high severity and remote reach makes the flaw a high‑risk target.