A race condition exists in the Skia graphics library used by Google Chrome on macOS that permits a remote attacker to execute arbitrary code inside the browser sandbox. By delivering a specially crafted HTML page, an attacker can trigger the race and break out of the sandbox, thereby enabling malicious code to compromise the underlying operating system. This flaw is a typical remote code execution scenario and poses a serious risk to confidentiality, integrity, and availability for the affected user.

Google Chrome browsers on macOS runing versions prior to 151.0.7922.72 are affected. The flaw specifically involves the Skia rendering component and can be triggered by any vulnerable Chrome instance on macOS.

The CVSS score of 8.8 indicates a high severity, while an EPSS score of less than 1% shows that active exploitation is unlikely at this time. The vulnerability is not listed in the CISA KEV catalog, reflecting no publicly known exploits. Exploitation requires a remote attacker to supply a maliciously crafted HTML page that the target visitor renders in Chrome. When this race is triggered, code runs inside the browser sandbox and can escape to the host OS. No special operating‑system privileges or configuration are required beyond normal Chrome usage, making the attack broadly applicable to all macOS users of affected Chrome versions.