This vulnerability is a race condition (CWE-362) in the USB handling code of Google Chrome before version 150.0.7871.47. An attacker who has already compromised the renderer process can exploit this flaw by delivering a specially crafted HTML page, potentially escaping the browser's sandbox. This could lead to full system compromise or unauthorized access beyond the browser sandbox. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. The vendor has published an advisory but has not explicitly stated the remediation level or patch availability in the provided data. The affected versions include all Chrome versions prior to 150.0.7871.47.

Successful exploitation allows a remote attacker who has compromised the renderer process to escape the Chrome sandbox, potentially gaining elevated privileges or access to the underlying system. This compromises the browser's security boundary, leading to high confidentiality, integrity, and availability impacts as indicated by the CVSS score.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html for current remediation guidance. Until a patch is confirmed and applied, users should exercise caution when visiting untrusted websites and avoid interacting with suspicious content that could trigger the vulnerability.