The vulnerability is a race condition in the Chrome DevTools implementation on macOS that can allow a remote attacker who has already managed to compromise the renderer process to exploit a crafted HTML page that triggers an out‑of‑order execution path. This race can break the isolation guarantees of the sandbox and enable the attacker to escape the per‑process sandbox, potentially gaining stronger privileges on the host. Failure to contain the renderer means that code executing within the browser could run arbitrary native code, compromising confidentiality, integrity, and availability. The weakness maps to concurrent bug and thread synchronization (CWE‑362) and race condition involving shared resources (CWE‑368).

The affected vendor is Google, product Chrome. The issue applies to macOS releases of Chrome older than 151.0.7922.72. All versions before this revision are vulnerable until the security patch is applied. Users of Chrome on Mac should update to at least 151.0.7922.72.

CVSS 9.6 indicates high severity, but the EPSS of less than 1% suggests the probability of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog, meaning no known widespread exploitation. However, the attack requires prior compromise of the renderer process, which typically occurs through malicious web content or compromised site. If an attacker can gain that foothold, the race could be triggered by a crafted HTML page load, giving them a path to escape the sandbox. No publicly disclosed exploits exist at this time, but the logical attack chain remains viable, especially for attackers with advanced web‑based malware capabilities.