A race condition in the DevTools module of Google Chrome allows a remote attacker who has already compromised the renderer process to potentially escape the sandbox by serving a specially crafted HTML page. The flaw can give the attacker elevated privileges, enabling execution of arbitrary code on the host system. The vulnerability stems from improper input validation (CWE‑20) and is considered high severity.

Google Chrome versions prior to 149.0.7827.197 are affected. The issue affects all desktop builds of the stable channel. No other vendors or products are listed.

The flaw can be exploited once an attacker has gained a foothold in the renderer process, which is often achieved through other exploit chains or social engineering. EPSS data is unavailable, and the vulnerability is not currently listed in CISA KEV. The CVSS score of 8.3 indicates a high severity, but without proof of widespread exploitation the exact likelihood remains uncertain.