CVE-2026-5902

OVERVIEW CVE-2026-5902 is a race condition vulnerability affecting Google Chrome on Android versions prior to 147.0.7727.55. The flaw exists in the Media component and allows a remote attacker who has already compromised the renderer process to corrupt media stream metadata through a specially crafted HTML page. SEVERITY This vulnerability carries a CVSS score of 9.8 (Critical) with a network-based attack vector requiring no authentication, low attack complexity, and no user interaction. Despite Chromium's assessment of Low severity, the vulnerability has potential for high impact across confidentiality, integrity, and availability. The EPSS score of 0.0009 indicates minimal probability of exploitation in the wild relative to other disclosed CVEs. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability is not listed in the Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat intelligence hot lists. No public exploit code is readily available, and community attention appears limited, suggesting low real-world threat maturity at this time.