Insufficient Policy Enforcement in Chrome PWAs Enables Unauthorized Installation

Publication date: 2026-04-08

Last updated on: 2026-04-14

Assigner: Chrome

Description

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-08

Last Modified

2026-04-14

Generated

2026-07-06

AI Q&A

2026-04-09

EPSS Evaluated

2026-07-05

NVD

CVE-2026-5892

EUVD

EUVD-2026-20711

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 147.0.7727.55 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1268	The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies.

Attack-Flow Graph

Executive Summary

This vulnerability involves insufficient policy enforcement in Progressive Web Apps (PWAs) within Google Chrome versions prior to 147.0.7727.55. It allows a remote attacker who has compromised the renderer process to install a PWA on the user's device without their consent by using a specially crafted HTML page.

Impact Analysis

The impact of this vulnerability is that an attacker who has control over the renderer process can silently install PWAs on your device without your permission. This could lead to unauthorized applications running on your system, potentially exposing you to further attacks, privacy risks, or unwanted software installations.

Hi! I’m here to help you understand CVE-2026-5892. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70