Race condition in the MHTML processor of Google Chrome allows an attacker who has tricked a user into installing a malicious extension to read cross‑origin data. The attacker crafts a malicious Chrome Extension to trigger the race, causing the extension to gain access to data it should not see. This vulnerability is a race condition (CWE-362) involving improper synchronization (CWE-368) and results in unauthorized disclosure of sensitive information.

The flaw exists in Google Chrome for desktop, affecting all versions prior to 147.0.7727.138. Any machine running those versions and with the ability to install third‑party extensions is impacted. Upgrading to Chrome 147.0.7727.138 or later resolves the issue.

The CVSS score is 3.1 (low severity). The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. The vulnerability is not listed in CISA KEV. The exploitation requires the user to install a malicious extension, so it depends on social engineering or deceptive content. However, once installed, the attacker can read cross‑origin data from the victim’s browsing context.