This vulnerability arises from insufficient policy enforcement in PWAs within Google Chrome versions before 147.0.7727.55. An attacker with limited privileges (renderer process compromise) can leverage this flaw to install a PWA without user interaction by delivering a specially crafted HTML page. The CVSS score of 6.6 reflects a medium severity with local attack vector, low attack complexity, requiring low privileges and user interaction, impacting integrity and availability but not confidentiality. The issue is tracked as CWE-1268.

Successful exploitation allows an attacker who has compromised the renderer process to install a PWA on the victim's system without their consent. This could lead to unauthorized application installation, potentially affecting system integrity and availability. Confidential data confidentiality is not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for current remediation guidance. Since the vulnerability affects versions prior to 147.0.7727.55, updating Chrome to version 147.0.7727.55 or later is recommended once confirmed by the vendor. No additional mitigation steps are specified in the advisory.