Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)
The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
| Link | Tags |
|---|---|
| https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop.html | release notes |
| https://issues.chromium.org/issues/341136300 | issue tracking exploit |