A race condition in Chrome extensions allows a remote attacker who employs social engineering to bypass system access restrictions via a crafted extension. The flaw can enable the attacker to read memory inside the sandbox, potentially disclosing sensitive data. While the Chrome sandbox limits overall impact, the disclosure can assist in constructing a more advanced attack.

The vulnerability affects Google Chrome for desktop on all versions prior to 156.0.8078.47. Only the Chrome product is listed, and the issue is tied to potentially unsafe extension code paths.

The CVSS score of 6.5 classifies the vulnerability as moderate severity. The EPSS score of < 1% indicates a low likelihood of exploitation. Because the vulnerability is not listed in the CISA KEV catalogue, no current evidence of widespread exploitation exists. The primary attack vector is remote, requiring an attacker to host or drive a malicious HTML page that a user opens, thereby enabling the extension to trigger its race condition and read sandbox memory.