A race condition in the Payment subsystem of Google Chrome versions earlier than 148.0.7778.168 enables a remote attacker to trigger a sandbox escape through a specially crafted HTML page. This flaw originates from a concurrency issue (CWE-362) and a priority‑inversion problem (CWE-368) that could allow the attacker to break out of the renderer process sandbox and execute code with higher privileges on the client system.

The vulnerability affects Google Chrome browsers running any version older than 148.0.7778.168 on desktop platforms. The affected versions are those listed in the official Chrome release notes prior to the 148.0.7778.168 update.

The EPSS score is not available, and the vulnerability is currently not listed in the CISA KEV catalog. The description indicates that realistic exploitation requires delivery of a crafted HTML page, implying a web‑based attack vector. While the CVSS score is 8.3, the Chromium security team has labeled the issue as Critical, suggesting that a successful exploitation would result in complete code execution on the host. The lack of an available EPSS score means the current information cannot quantify the likelihood of exploitation, but the combination of a critical severity rating and the remote nature of the attack vector indicates a high risk to affected users. This assessment is based solely on the supplied information and acknowledges that some impact details remain unspecified.