A race condition in the Extensions module of Google Chrome earlier than 156.0.8078.47 permits a remotely‑delivered page to trigger memory corruption, allowing code execution within the renderer sandbox. The updated description refines the details of the race but preserves the same core flaw: unsafe handling of extension data and a resulting race condition (CWE‑367). An attacker can gain control of the sandboxed process and possibly escape it if additional weaknesses exist, thus compromising confidentiality, integrity, and availability.

Any user running Google Chrome earlier than 156.0.8078.47 is affected. The issue targets the Extensions component inside Chrome’s rendering engine. Based on the description, it is inferred that all platforms where Chrome runs (Windows, macOS, Linux) are susceptible as long as the browser is running a vulnerable version.

The CVSS score of 8.8 marks this vulnerability as high severity. The EPSS score is <1%, indicating a very low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious web page that the victim opens, which may be delivered via phishing or compromised content. Once the extension memory corruption is triggered, code runs in the sandbox; further privilege escalation depends on additional vulnerabilities. Because of the severity, a timely patch is recommended.