A race condition exists in the V8 JavaScript engine of Google Chrome versions earlier than 153.0.8010.36. The flaw allows a remote attacker to craft an HTML page that triggers concurrent operations in the engine, causing the browser to execute arbitrary code within the sandboxed Chrome process. The CVE description does not indicate any bypass of sandbox boundaries, so the code runs with the same limited privileges as the browser process and does not automatically lead to full system compromise.

The vulnerability affects all Google Chrome releases before 153.0.8010.36 on every supported operating system and platform. Users who have not updated to a fixed build are exposed to the race condition.

The CVSS score of 7.5 shows a moderate‑to‑high severity classification, yet the EPSS score of under 1% reflects a very low probability of observed exploitation. The flaw is not listed in the CISA KEV catalog. The attack vector is remote; an attacker must convince a victim to open a malicious HTML page in Chrome. The exploitation results in code execution confined to the sandboxed browser process, limiting impact to the browser context and not the underlying operating system.