Race condition in the V8 JavaScript engine allowed a crafted HTML page to trigger concurrent operations that result in arbitrary code execution inside the browser's sandbox. The flaw could be abused by a remote attacker who delivers the special page to a victim, enabling the attacker to run programs with the privileges of the compromised browser process. The weakness is classified as CWE‑362. The stated Chromium severity is high.

All Chrome users running Google Chrome on the stable channel before version 157.0.8103.38 are potentially affected. The vulnerability is present in earlier releases of Chrome built with the V8 157.0.8103.38 baseline or earlier. The latest stable desktop update addresses this issue.

The CVSS score is not provided in the advisory, and the EPSS score is unavailable, but the risk remains high because the vulnerability requires no special permissions and can be triggered by any web page. The exploitation path involves a user opening a maliciously crafted HTML document delivered over the Internet or locally. No known public exploit has been reported, and the issue is not listed in the CISA KEV catalog. Administrators should treat this as a critical patch required for all users who can visit the Internet.