A race condition in Chrome’s USB handling enables a remote attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code. By delivering a specially crafted HTML page, the attacker can trigger the vulnerability, resulting in code execution and potential privilege escalation beyond the browser sandbox. The weakness is a classic race condition, identified as CWE‑367 and CWE‑368.

Google Chrome is affected for versions earlier than 151.0.7922.169.

The vulnerability is rated 8.3 in CVSS, indicating a high severity level. The EPSS score of <1% suggests a low but nonzero probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation requires the attacker to first compromise the renderer process, typically via a malicious website, and then deliver malicious HTML to trigger the race condition. While no public exploits have been reported, the lack of an active exploit and the need for a prior compromise reduce the immediate risk, but the high severity and sandbox escape capability warrant prompt action.