The vulnerability is a race condition in Chrome’s Safe Browsing component on macOS, involving both a classic data‑race (CWE‑362) and a time‑of‑check to time‑of‑use flaw (CWE‑367). When an attacker can compromise the renderer process, a malicious file can trigger the race, enabling the attacker to escape the sandbox and potentially execute arbitrary code. The impact is loss of confidentiality, integrity, and availability for the affected user, as sandbox escape allows full control of the browser process.

All macOS installations of Google Chrome versions prior to 149.0.7827.115 are affected. The issue is specific to the Chrome Stable channel on macOS where Safe Browsing is enabled.

The CVE is rated High by Chromium security, with an EPSS score of < 1% and it is not listed in the CISA KEV catalog. Exploitation requires the attacker already to have compromised the renderer process, implying a more involved attack chain. While the risk is not zero, the low EPSS score and the need for a pre‑existing compromise reduce the likelihood, yet patching remains the safest defence.