Race condition in the FileSystem component of Google Chrome allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by loading a crafted HTML page. The vulnerability is a synchronization flaw (CWE-367) that can be triggered during concurrent file operations, granting the attacker full control over the host system because the code runs with privileges higher than the browser sandbox.

Google Chrome versions prior to 152.0.7977.65 are affected. The issue is present in the stable channel of the browser and applies to all platforms supported by Chrome for which the renderer process can be compromised.

The vulnerability has a high severity rating (CVSS 8.3) and is not currently listed in the CISA KEV catalog. The EPSS score of <1% indicates that exploitation is unlikely to occur frequently in the wild. Based on the description, the attack requires a remote attacker that has already taken control of the renderer process, often through another vulnerability or social engineering. Once the renderer is compromised, the race condition can be triggered by a maliciously crafted HTML page, allowing arbitrary code execution on the host with elevated privileges.