It's unfortunately a relatively complex thing to answer.

First off, there's the license. The source code is published under a BSD-3 license, which is very permissive, meaning in theory, anyone could fork the repository and be completely free from any control of Google.

However, this is not really a thing in reality.

First of all, for your fork to have any meaning at all, you need people to use it. They're not going to use your fork, if it's unclear whether you're trustworthy and in particular, you need to offer something better than Google and do so for a while, so that people feel like they can rely on you.

Google is also not bound by its license to make future updates available under the same license. If your fork would become too successful, they could re-license and then it would genuinely just become a competition for who has more dev power.
But with the additional caveat that if you don't also re-license, then Google can continue taking your work and provide theirs on top.

Google also has a load of tracking infrastructure and an ad business, which makes Chrome a valuable investment for them.
There's very few other organizations for which it would make sense to invest similarly much into Chromium development (and those organizations will then have similarly awful motivations).
Which means a hard fork, i.e. without dependence on future updates from Google, is pretty much not going to happen.

Additionally, you'd need a solid number of users in your fork, if you want to have any say in terms of web standards. So long as Google Chrome has a majority of users, Google can easily introduce proprietary standards, which webdevs will gladly lap up.

So, all in all, Google does have a pretty tight grip.
Presumably, they don't put any incriminating stuff into Chromium, so that they steer clear of even faint attempts to fork (and because they can just put those into Google Chrome instead).
But there's plenty room for interpretation in most web standards, so they can implement them in their interest, and then the forks have to stick to that implement, if they want to remain compatible with the web.