The vulnerability is a race condition in Chrome’s updater on macOS versions prior to 149.0.7827.155. A remote attacker who has already compromised the renderer process can trick the browser into escaping its sandbox by loading a specially crafted HTML page. This attack could allow malicious code to run with elevated system privileges, representing a high‑severity vulnerability.

Google Chrome on macOS, any build before version 149.0.7827.155. The affected releases are those that run the vulnerable updater component on the Mac operating system.

The CVSS score of 8.3 indicates high severity, and the EPSS score (< 1%) suggests a very low probability that this flaw will be actively exploited in the wild. It is not listed in CISA’s KEV catalog. However, the vulnerability could lead to remote code execution if an attacker controls the renderer process. The attack vector requires the attacker to first gain a foothold in the browser’s renderer, then deliver a malicious HTML payload that triggers the race condition in the updater component. Because the flaw is tied to a race condition, successful exploitation depends on timing and the precise state of the updater during the browser’s operation. Organizations using older Chrome releases on macOS should treat this as a priority to patch.