External risk intelligence

Google Chrome for Android Media Race Condition

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-5902

This vulnerability requires the attacker to have already compromised the renderer process of the web browser. It is a client-side issue affecting the browser application itself rather than a public-facing service, network infrastructure, or externally reachable server component.

Google Chrome

before 147.0.7727.55

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability was identified in Chrome on Android that could allow an attacker to corrupt media data through a specially crafted webpage. While the initial impact is assessed as low, confirmation of relevance and exposure is recommended.

A browser flaw could corrupt media data.
Understand potential impact on media streaming.
Confirm if this affects your Android Chrome users.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user into visiting a malicious webpage. If successful, the attacker could then corrupt media metadata within the browser's renderer process, potentially leading to information disclosure and modification.

Attacker must compromise renderer process first.
Triggered by viewing a crafted HTML page.
Risk of data corruption and modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow a remote attacker, after compromising the browser's renderer process, to corrupt media stream metadata through a malicious HTML page. This might affect the integrity or availability of media playback when supported by the advisory.

Media stream metadata.
Corrupted via a crafted HTML page.
Affects media playback integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects the Chrome browser on Android, specifically the media processing component. Responsibility for addressing this typically falls to the platform or device management team, in coordination with the vendor. The initial step is to identify all Android devices running affected Chrome versions and assess their exposure, prioritizing those with greater business criticality or broader user impact.

Platform/Device Management owns remediation.
Verify affected Chrome versions and devices.
Plan vendor coordinated updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome for Android?

Google Chrome for Android is a widely used mobile web browser that allows users to navigate the internet, render complex web content, and stream media. It includes a sophisticated media processing component responsible for handling audio and video streams. This software acts as a container for web applications, isolating untrusted web content from the underlying Android operating system to provide a secure browsing environment.

How does CVE-2026-5902 work?

This vulnerability is classified as a race condition (CWE-362). It occurs when the browser's media processing logic does not handle simultaneous operations correctly during media stream playback. By manipulating the timing of these internal processes, an attacker can cause data corruption in the media metadata, potentially leading to unauthorized modification of information within the browser's memory.

Do I need to visit a malicious site to trigger this?

Yes, an attacker must successfully trick a user into viewing a specifically crafted HTML page to initiate the exploit. However, simply navigating to a site is not enough on its own; the attacker must first have already compromised the browser's renderer process. This means standard web navigation on reputable, secure sites does not trigger this vulnerability.

Is this CVE a risk for my public-facing servers?

According to Halo Surface Signal, this is highly unlikely. The vulnerability is a client-side issue located within the browser software on end-user devices. It does not affect network infrastructure, public-facing server components, or backend services, meaning your server-side configurations are generally not the focus of this specific threat.

How do I address this Chrome vulnerability?

The primary response is to ensure Chrome on all Android devices is updated to version 147.0.7727.55 or later, where this flaw is resolved. You should coordinate with your device management or mobile platform teams to audit your device fleet, identify outdated browser installations, and prioritize the rollout of these vendor-provided updates to your user base.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.