CVE-2026-5892
Insufficient Policy Enforcement in Chrome PWAs Enables Unauthorized Installation
Publication date: 2026-04-08
Last updated on: 2026-04-14
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 147.0.7727.55 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1268 | The product's hardware-enforced access control for a particular resource improperly accounts for privilege discrepancies between control and write policies. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability involves insufficient policy enforcement in Progressive Web Apps (PWAs) within Google Chrome versions prior to 147.0.7727.55. It allows a remote attacker who has compromised the renderer process to install a PWA on the user's device without their consent by using a specially crafted HTML page.
How can this vulnerability impact me? :
The impact of this vulnerability is that an attacker who has control over the renderer process can silently install PWAs on your device without your permission. This could lead to unauthorized applications running on your system, potentially exposing you to further attacks, privacy risks, or unwanted software installations.