A race condition exists in the V8 JavaScript engine used by Google Chrome. The flaw allows a remote attacker to craft a malicious HTML page that, when processed by the browser, can trigger concurrent operations that lead to the execution of arbitrary code inside the sandboxed process. The weakness is classified as a timing and race condition (CWE-367). As a result, an attacker can potentially hijack the browser’s sandbox boundaries and compromise the client’s system.

The vulnerability affects all installations of Google Chrome that are older than version 157.0.8103.38. Any device running a Chrome release prior to this build is susceptible when the user visits a page containing the crafted payload.

The flaw carries a Chromium severity of Medium, indicating that exploitation could have significant impact. The attack requires a user to load a malicious web page and a successful race condition between internal V8 components. Because there is no EPSS score, the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the ability to bypass the sandbox makes it a high‑value target for adversaries seeking to execute code on the client machine.