A race condition exists in the network process of Google Chrome on macOS when a remote attacker already controls the network process. The flaw allows the attacker to execute arbitrary code beyond the sandbox by delivering a specially crafted HTML page. This can lead to full system compromise. The weakness is identified as CWE‑362, a concurrent execution issue. Based on the Chromium severity, it is considered high risk.

The vulnerability affects Google Chrome for macOS versions prior to 149.0.7827.103. All users running those releases are potentially at risk until they update to the referenced release or later.

The exploitation path requires that an attacker first gain control of Chrome’s network process, after which the crafted HTML triggers a race that breaks out of the sandbox. Although EPSS data is unavailable and the issue is not listed in CISA's KEV catalog, the high Chromium severity and the CVSS score of 8.3 highlight a significant potential impact if exploited, with the nature of a sandbox escape indicating elevated risk. Attackers could leverage this flaw remotely by delivering malicious content over a compromised network channel.