Technical impact
A race condition exists in Google Chrome's editing feature, enabling a remote attacker who succeeds in social engineering a user to load a specially crafted HTML page. The flaw can lead to disclosure of sensitive data that the user has recently edited, without any exploitation of code execution or denial of service. The weakness is identified as a race condition (CWE-367).
Affected Systems
Affected systems are Google Chrome browsers on all platforms running a build prior to version 152.0.7977.65. The specific crash involves the editing component invoked when a page is loaded, regardless of operating system. Users on earlier releases should be aware that any recent edits may be exposed through this flaw.
Risk and Exploitability
The CVSS score is 5.3, which is low and aligns with Chromium's low severity classification. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA's KEV catalog. The attack vector requires the victim to open a malicious HTML page, which can be delivered through phishing or compromised websites. While the likelihood of exploitation is not quantified, social engineering remains the practical prerequisite; patches address the race condition directly.
Debian DLA
Debian DSA