A race condition in Google Chrome’s media handling allows a renderer process that has already been compromised to overwrite media stream metadata using a crafted HTML page. The corrupted metadata can misrepresent media playback or force the browser to process incorrect data, potentially leading to information disclosure or denial of service. The flaw is classified as a race condition (CWE‑362) and an atomicity violation (CWE‑368).

Google Chrome on Android versions before 147.0.7727.55 is affected. No other browsers or operating systems listed in the CPEs are confirmed to be vulnerable based on the current advisory.

The CVSS base score of 9.8 signals a high severity, but the EPSS is less than 1 % indicating low current exploitation activity. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require delivering a malicious HTML page to a user whose renderer process is already compromised, implying a sophisticated local or remote attack. The race condition itself may be hard to trigger reliably, but if achieved it can alter media metadata with significant impact on user experience and data integrity.