PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5892 Google CVE debrief

CVE-2026-5892 is a Medium severity vulnerability in Google Chrome, specifically in its handling of Progressive Web Apps (PWAs). Insufficient policy enforcement in PWAs allowed a remote attacker, who had compromised the renderer process, to install a PWA without user consent via a crafted HTML page. This vulnerability has a CVSS score of 6.6 and is considered Medium priority. Users of Google Chrome prior to version 147.0.7727.55 are affected and should apply the update to prevent potential exploitation.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should apply the update to prevent potential exploitation of this vulnerability. This includes administrators and users of Chrome in managed environments, who should review and apply the necessary updates as part of their regular security practices. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems.

Technical summary

The vulnerability, CVE-2026-5892, exists in Google Chrome's handling of Progressive Web Apps (PWAs). An attacker who has compromised the renderer process can exploit this insufficient policy enforcement to install a PWA without user consent. This can be achieved through a specially crafted HTML page. The vulnerability has been rated as Medium severity with a CVSS score of 6.6. It is recommended that users update Google Chrome to version 147.0.7727.55 or later to mitigate this vulnerability.

Defensive priority

Medium priority due to the potential for exploitation by a compromised renderer process. It is recommended that users update Google Chrome to version 147.0.7727.55 or later to mitigate this vulnerability.

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later
  • Ensure that Chrome's auto-update feature is enabled
  • Monitor Chrome's version and update as necessary
  • Consider implementing additional security measures for PWA installations
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.083Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. This vulnerability affects Google Chrome versions prior to 147.0.7727.55. The vulnerability has been rated as Medium severity with a CVSS score of 6.6. The CVE record was sourced from nvd_modified.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5892 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5892

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5892 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5892

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.