A timing bug is a flaw where security depends on operations happening in the right order, or within the right window, and that assumption turns out to be false. If a check runs too late, a value changes before it is used, or two actions race each other, an attacker may slip past a control that looks correct in code.
These bugs matter because many defenses rely on state, sequence, and synchronization. In real attacks, timing bugs can help bypass authentication checks, confuse permission logic, or expose data in protected components such as sandboxes, enclaves, and privileged services. Defenders look for race conditions, inconsistent state transitions, and time-of-check/time-of-use gaps, then reduce risk with atomic operations, locks, stronger state validation, and designs that avoid trusting values after they may have changed.