CVE-2026-5902
Published: 08 April 2026
Summary
CVE-2026-5902 is a critical-severity Race Condition (CWE-362) vulnerability in Google Chrome. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-5902 is a race condition vulnerability (CWE-362) in the Media component of Google Chrome on Android versions prior to 147.0.7727.55. The issue allows a remote attacker who has compromised the renderer process to corrupt media stream metadata via a crafted HTML page. Although rated Low severity by Chromium security, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires prior compromise of the Chrome renderer process by a remote attacker. With that access, the attacker can use a crafted HTML page to trigger the race condition and corrupt media stream metadata, enabling high-impact confidentiality, integrity, and availability effects as scored by CVSS.
Mitigation is achieved by updating to Google Chrome on Android version 147.0.7727.55 or later. Official advisories include the Chrome Releases stable channel update at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html and the Chromium issue details at https://issues.chromium.org/issues/483109205.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-20726
Vulnerability details
Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in Chrome renderer (post-initial compromise) enables metadata corruption with full CIA impact, directly facilitating client application exploitation (T1203) and privilege escalation from sandboxed renderer (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the race condition vulnerability by requiring timely patching of Google Chrome on Android to version 147.0.7727.55 or later.
Enforces process isolation to limit the impact of a compromised renderer process, preventing corruption of media stream metadata from affecting other system processes.
Implements memory protections like ASLR and stack canaries that can disrupt exploitation of the race condition in media stream metadata handling.