The vulnerability is a race condition in the Core component of Google Chrome for Android prior to release 156.0.8078.47. When a renderer process is compromised, a remote attacker can deliver a crafted HTML page that triggers the race condition, enabling an out‑of‑bounds read and potentially allowing execution of arbitrary code outside the browser sandbox. This flaw, identified as CWE-125 and CWE-367, could give an attacker code execution with the privileges of the Chrome process, impacting confidentiality, integrity, and availability of the device.

Google Chrome for Android versions prior to 156.0.8078.47 are affected. Any Android device running an older Chrome release with the browser installed is vulnerable to exploitation via crafted HTML content.

The CVSS score of 8.8 classifies the flaw as High severity. The EPSS score is <1%, indicating a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed public exploits yet. The attack vector is remote: an adversary can deliver a malicious HTML page through a website, email attachment, or other web‑based channel. Users of affected Chrome versions that browse the internet are exposed, and the risk remains significant until the vulnerability is patched.