What is the CVSS score of CVE-2026-5902?

CVE-2026-5902 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Chrome are affected by CVE-2026-5902?

Google Chrome for Android versions prior to 147.0.7727.55 contain a critical-rated race condition in media stream handling that could allow attackers to corrupt metadata, but only after first…. A patch is available.

How to fix or mitigate CVE-2026-5902?

Within 24 hours: Notify mobile device management (MDM) teams of Chrome version requirements. Within 7 days: Deploy Chrome 147.0.7727.55 or later via MDM to all Android devices running Chrome prior to this version; prioritize devices with high-sensitivity use cases. Within 30 days: Confirm deployment completion and validate Chrome version across managed inventory.

Chrome CVE-2026-5902

EUVD-2026-20726 CRITICAL

Race Condition (CWE-362)

2026-04-08 Chrome

GHSA-mxfw-g2rw-x783

Information Disclosure Google Race Condition Red Hat Suse Chrome

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Low–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Red Hat

3.7 LOW

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:28 vuln.today

CVSS changed

Apr 13, 2026 - 19:37 NVD

9.8 (CRITICAL)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20726

CVE Published

Apr 08, 2026 - 21:21 nvd

N/A

DescriptionCVE.org

Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HTML page. (Chromium security severity: Low)

AnalysisAI

Media stream metadata corruption in Google Chrome for Android prior to 147.0.7727.55 enables remote attackers who have already compromised the renderer process to corrupt media stream metadata via a race condition (CWE-362) in the Media component. Despite a critical CVSS 9.8 score with network-accessible attack vector, real-world exploitation requires pre-compromise of the renderer, and EPSS probability is very low (0.03%, 9th percentile). Vendor patch released in Chrome 147.0.7727.55. No public exploit or active exploitation (KEV) identified at time of analysis. Chromium rates this Low severity, contrasting sharply with the theoretical CVSS rating.

Technical ContextAI

This vulnerability stems from a race condition (CWE-362) in the Media component of Google Chrome's Android implementation. Race conditions occur when multiple threads access shared resources concurrently without proper synchronization, creating time-of-check to time-of-use (TOCTOU) windows. In Chrome's architecture, the renderer process operates in a sandboxed environment isolated from system privileges. Media stream handling involves coordinating audio/video capture, processing, and delivery across thread boundaries. The race condition allows manipulation of metadata structures during concurrent access, potentially corrupting data integrity checks or object state. The CPE identifier cpe:2.3:a:google:chrome confirms this affects the Google Chrome browser application specifically on Android platforms, distinguishing it from desktop Chrome variants which may have different media pipeline implementations.

RemediationAI

Update Google Chrome for Android to version 147.0.7727.55 or later, which contains the vendor-released patch addressing the race condition in the Media component. The fix was released via Chrome's stable channel update in April 2026. Users should enable automatic updates in Chrome settings or manually update through the Google Play Store. Enterprise deployments should prioritize update rollout according to normal patch cycles given the low EPSS risk and prerequisite renderer compromise requirement. No effective workarounds exist beyond disabling media stream features entirely, which would severely impact browser functionality. Full vendor advisory available at http://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html with technical implementation details in Chromium bug tracker issue 483109205.