A race condition in the Chromoting component of Google Chrome before 156.0.8078.47 allows a remote attacker to bypass system access restrictions by sending specially crafted network traffic. This flaw does not provide code execution; it merely permits the attacker to access resources or privileges that should normally be restricted within the browser context. The weakness is identified as a race condition (CWE-362).

Google Chrome desktop releases built on Chromium prior to build 156.0.8078.47 are vulnerable. All version numbers earlier than 156.0.8078.47 should be considered at risk.

The CVSS score of 6.5 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves remote network traffic targeting the Chromoting module, possibly from a malicious web page or server interacting with the browser. Overall, the risk is moderate but exploitation is currently unlikely.