CVE Catalog
CVE-2026-5892
MediumCVSS 6.6Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
Google Chrome prior to version 147.0.7727.55 has insufficient policy enforcement in PWAs, allowing a remote attacker who compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Severity: Medium)
Risk Assessment
An attacker can install a malicious PWA without user consent, potentially leading to persistent data access or further attacks.
Recommendation
Update Google Chrome to version 147.0.7727.55 or later, which includes the fix.
Original NVD description (English source)
Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)