A race condition exists in the DevTools of Google Chrome before version 154.0.8037.57 that allows a remote attacker to bypass site isolation through a crafted Chrome extension. The exploit requires social engineering to convince a user to install the malicious extension. If successful, the attacker can violate Chrome’s same‑origin policy by executing code in the context of a target site, potentially accessing sensitive data or hijacking the user’s session. The weakness maps to CWE‑367, which focuses on race conditions.

Google Chrome browsers running any version prior to 154.0.8037.57 are impacted. The vulnerability affects all platforms where Chrome is available, as the race occurs in the browser’s DevTools stack regardless of operating system.

The CVE is rated Medium in Chromium’s internal severity scale. The EPSS score is < 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating it is not a known exploited vulnerability at this time. The CVSS score is 8. The attack vector is inferred to be remote, contingent upon the victim’s social engineering and installation of a malicious extension. While exploitation requires user interaction, the impact of successfully bypassing site isolation is significant as it undermines Chrome’s core defense against cross‑site data leakage.