The vulnerability CVE-2026-0147 affects Google Android and is caused by a missing bounds check in the function __mfc_core_nal_q_get_dec_metadata_sei_nal in the source file mfc_core_nal_q.c. This condition allows an out-of-bounds write, which may be exploited remotely to execute arbitrary code. Exploitation does not require user interaction or elevated privileges, increasing the risk of attack. No CVSS score or patch information is currently available, and no known exploits are reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely on affected Android devices without needing additional privileges or user interaction. This could lead to full compromise of the device or unauthorized control over its functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or mitigation details are currently available from the vendor. Users and administrators should monitor Google's security advisories for updates and apply patches promptly once released.