A race condition in the V8 JavaScript engine allows a remote attacker to execute arbitrary code inside the Chrome sandbox by serving a specially constructed HTML page. The flaw exploits a timing issue to violate access control, enabling code execution with the privileges of the browser process, potentially compromising data or system resources. The vulnerability is identified as CWE-362.

The vulnerability affects Google Chrome versions before 153.0.8010.36 on all platforms. Users running any earlier release are susceptible; newer releases contain the fix.

No EPSS score is available, and the issue is not listed in CISA's KEV catalog, indicating low observed exploitation. Nonetheless, the attack vector is remote via web content, and exploitation requires a malicious web page to be opened by a victim. Once the race condition is triggered, code runs in the sandbox, potentially elevating to full system compromise if the sandbox is breached. The low severity rating does not negate the potential impact of arbitrary code execution.