This race condition in Chrome's Picture-in-Picture API carries a CVSS 6.5 but Chromium rated it 'Low' severity—and for once, the vendor rating is more informative than the base score. The vulnerability allows domain spoofing during PiP window transitions on Android, but exploiting it requires winning a timing race during a UI state change that Chrome itself manages. That's inherently probabilistic and difficult to script reliably. The EPSS score of 0.00146 corroborates minimal active exploitability.
What should concern you isn't the current exploitability—it's the class this belongs to. Browser UI state race conditions (fullscreen API, getDisplayMedia, notifications) consistently follow a pattern: initially rated theoretical or low-severity, then weaponized within 12-24 months as researchers characterize the timing windows and publish tooling. This PiP race fits that genetic sequence exactly. The 'crafted HTML page' vector also removes the infrastructure barrier that historically slowed desktop exploitation.
The Android dimension amplifies the risk differently than past vulnerabilities. Android isn't a niche platform—it's the dominant mobile OS, and it runs Chrome alongside banking apps and authentication flows that users trust precisely because of visual isolation. More critically, Android fragmentation means Chrome patches don't deploy uniformly. The vulnerability was patched in Chrome 151, but devices on Chrome 150 or earlier remain exposed, and many will stay that way for weeks or months—or permanently on older devices. That population of unpatched devices is already in the 'exploitable' state; they aren't waiting for researchers to characterize the race window.
For operational decisions, prioritize your Android Chrome population over generic severity scoring. Ensure Chrome updates are being applied to mobile endpoints, especially in security-sensitive environments. Monitor this as a class vulnerability: expect the timing constraints to be characterized and the exploit barrier to drop. The 'Low' severity rating likely reflects Chromium's awareness that this class tends to evolve, not confidence that it's unlikely to be exploited.