The flaw is a race condition in the Views component of Google Chrome on macOS that can result in a use‑after‑free. If a remote attacker has already compromised the renderer process, a crafted HTML page that spoofs UI elements can trigger the race condition, allowing the attacker to execute arbitrary code within the Chrome renderer process.

Google Chrome on macOS versions before 156.0.8078.47, including stable channel installations on all macOS releases.

With a CVSS score of 8.8 the vulnerability is considered high severity, but the EPSS score of less than 1% indicates a very low expected exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to have already compromised the renderer process and to supply a malicious HTML page, typically achieved through phishing or compromised web content.