The vulnerability is a race condition in the Chrome installer on macOS that allows a local attacker to execute arbitrary code outside the Chrome sandbox. The flaw, reported as an out‑of‑bounds read, can be triggered by executing a local program during installation or update. This timing issue may cause memory corruption that provides system‑level execution within the user context. The flaw is classified as a memory corruption problem (CWE‑367).

Google Chrome for macOS was affected. Any installation of Chrome before version 156.0.8078.47 on a Mac system is susceptible. Based on the release notes, it is inferred that the issue was addressed only in the stable channel.

Chromium rated the flaw as medium severity, with a CVSS score of 6.5 and an EPSS of less than 1%. Exploitation requires local execution skills: an attacker must be able to run a program that triggers the race condition during the installation or update of Chrome on an affected macOS machine. Successful exploitation can place the attacker’s code outside of Chrome’s sandbox, giving it system‑level privileges within the user context. The overall risk is moderate; the attack vector is local and does not require network access, but it can still provide significant impact for compromised hosts. The vulnerability is not listed in CISA’s KEV catalog.