A race condition exists in the V8 JavaScript engine within Google Chrome that allows a remote attacker to cause heap corruption by delivering a specially crafted HTML page. The resulting memory corruption can potentially be leveraged to execute arbitrary code on the victim’s machine, compromising confidentiality, integrity, and availability. The flaw is classified under concurrent modification and thread-scheduling weaknesses, reflected in CWE-362 and CWE-366.

The vulnerability affects any Google Chrome installation prior to version 147.0.7727.55, regardless of the operating system. This includes Chrome on Windows, macOS, and Linux desktop platforms, as the V8 engine is shared across all those environments.

The CVSS score of 6.8 places the flaw in the medium severity range, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is inferred from the description as a remote attacker delivering a crafted HTML page through a malicious website or phishing email, which then causes the heap corruption upon rendering. While exploitation is not currently widespread, a successful attack could provide full code execution on the affected system.