A race condition exists in the V8 JavaScript engine of Google Chrome that can be triggered by a specially crafted HTML page. This flaw allows a remote attacker to execute arbitrary code inside the browser’s sandbox, thereby escaping the isolation boundary. The weakness is classified as CWE-367 and CWE-368 and is considered a High severity vulnerability according to Chromium’s internal scoring.

All installations of Google Chrome prior to version 151.0.7922.173 are affected. The vulnerability applies to the stable channel of Chrome, and any client that does not receive the 151.0.7922.173 update remains susceptible.

Based on the description, it is inferred that the vulnerability can be exploited remotely over the internet using only a crafted web page. Based on the description, it is inferred that no additional user interaction beyond visiting the page is required. Although an EPSS score is < 1% and the flaw is not listed in the CISA KEV catalog, the CVSS score of 7.5 and the ability to breach the browser sandbox imply a substantial risk to confidentiality, integrity, and potentially availability of the victim’s system.