A race condition exists in the network process of Google Chrome on macOS when a remote attacker already controls the network process. The flaw allows the attacker to execute arbitrary code beyond the sandbox by delivering a specially crafted HTML page. This can lead to full system compromise. The weakness is identified as CWE‑362 and CWE‑368, both concurrent execution issues. Based on the Chromium severity, it is considered high risk.

The vulnerability affects Google Chrome for macOS versions prior to 149.0.7827.103. All users running those releases are potentially at risk until they update to the referenced release or later.

The exploitation path requires that an attacker first gain control of Chrome’s network process, after which the crafted HTML triggers a race that breaks out of the sandbox. Despite an EPSS score of 0.00061 indicating a very low but nonzero exploitation probability, and the issue not being listed in CISA’s KEV catalog, the high Chromium severity and the CVSS score of 8.3 highlight a significant potential impact if exploited, with the nature of a sandbox escape indicating elevated risk. Attackers could leverage this flaw remotely by delivering malicious content over a compromised network channel.