The reported race condition in Chrome’s WebRTC implementation exposes a remote threat actor with the ability to read cross‑origin data triggered by a specially crafted HTML page. The flaw relies on a timing mismatch inside the WebRTC stack and can be exploited without privileged access, leading to a breach of confidentiality for data protected by the same‑origin policy. The weakness is identified as CWE‑362, a classic race condition, and also falls under CWE‑366, indicating a potential use of objects after exposure.

Google Chrome for Windows, any build prior to 148.0.7778.216, including older stable releases.

The vulnerability is classified as high severity by the Chromium security team. Exploitation requires the victim to visit a malicious page that harnesses WebRTC; it does not provide remote code execution or privilege escalation. The EPSS score is <1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploitation data has yet been documented. However, the attack vector is remotely accessible via a standard web page, implying that any user who loads an untrusted site could become a victim. The CVSS score of 3.1 indicates low severity exposure.