This vulnerability involves a race condition (CWE-362) in the Media subsystem of Google Chrome on Android before version 147.0.7727.55. An attacker with control over the renderer process can exploit this flaw to corrupt media stream metadata via a specially crafted HTML page. The CVSS vector indicates the attack can be performed remotely without privileges or user interaction, resulting in high confidentiality, integrity, and availability impacts. The vulnerability is publicly disclosed with no explicit vendor remediation status provided in the advisory.

Successful exploitation can lead to corruption of media stream metadata, potentially affecting the confidentiality, integrity, and availability of media content within the browser. Given the high CVSS score (9.8), the impact is critical, implying severe consequences if exploited. However, exploitation requires prior compromise of the renderer process, which may limit the attack surface. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Until an official fix is confirmed, users should update to the latest Chrome version once available and avoid visiting untrusted or suspicious web pages that could trigger exploitation. No additional vendor-provided mitigations are indicated at this time.