CVE Intelligence
Analysis AI-assisted

CVE-2026-5902: Google Chrome for Android race condition in media stream metadata

A race condition in the Media component of Google Chrome on Android allows a remote attacker who has already compromised the renderer process to corrupt media stream metadata through a crafted HTML page. The record lists a CVSS base score of 9.8 from the CNA and CISA ADP, while Chromium rates the issue as Low severity. No confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

This record describes a race condition (CWE-362) in the Media component of Google Chrome on Android. According to the record, the attacker must be a remote party that has already compromised the renderer process, and the stated effect is corruption of media stream metadata via a crafted HTML page.

Impact

  • The record states the effect as corruption of media stream metadata.
  • The CNA and CISA ADP both carry a CVSS base score of 9.8, with the vector indicating network access, low complexity, no privileges, no user interaction and high impact to confidentiality, integrity and availability.
  • Inference: the CVSS score is much higher than the Chromium severity label of Low. The record does not explain this difference, so the real-world risk should be assessed with the vendor's own context.

Affected products and versions

  • Google Chrome on Android before 147.0.7727.55.
  • The record's affected entries are internally inconsistent: one range is below 147.0.7727.55 and the second is from 147.0.7727.55 up to 147.0.7727.55. The only usable boundary is 147.0.7727.55.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed active exploitation appears in the sources consulted.
  • SSVC fields in the record indicate exploitation none, automatable yes and technical impact total.
  • The EPSS probability is 0.0033 with a percentile of 0.24914.

Remediation and mitigation

  • Update Google Chrome on Android to 147.0.7727.55 or later, based on the boundary given in the record.
  • The fixes list in the record is empty. This does not mean no fix exists; check the vendor release notes linked below.
  • Use mobile device management or enterprise policies to inventory browser versions and confirm that updates were applied.

Detection guidance

  • Inventory Chrome versions on Android devices and flag any installation below 147.0.7727.55.
  • Review device management reports for outdated browsers, especially on devices used for sensitive work.
  • The sources consulted do not describe specific technical indicators of compromise, so version inventory is the main verifiable signal.

Limitations of the available information

  • The record has no explicit fixed-version field and the affected range is contradictory.
  • The linked release notes are titled for the desktop stable channel; confirm that they cover the Android build.
  • The Chromium issue tracker entry requires permissions, so its details could not be reviewed.
  • The EPSS date field reads 2026-10-23, which should be verified against the source before relying on it.
  • The English title was missing in the record and was written by the analyst.

Frequently asked questions

Which Chrome for Android versions are affected by CVE-2026-5902?

The record indicates versions before 147.0.7727.55 are affected. Its affected entries are contradictory, so 147.0.7727.55 is the only reliable boundary.

Is this vulnerability known to be actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed active exploitation appears in the sources consulted.

Why does the score differ from the Chromium severity?

The record lists a CVSS base score of 9.8 from the CNA and CISA ADP, while Chromium labels the issue Low. The record does not explain the difference.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.