PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5892 Google CVE debrief

CVE-2026-5892 is a Medium severity vulnerability in Google Chrome, specifically in its handling of Progressive Web Apps (PWAs). Insufficient policy enforcement in PWAs allowed a remote attacker, who had compromised the renderer process, to install a PWA without user consent via a crafted HTML page. This vulnerability has a CVSS score of 6.6 and is considered Medium priority. Users of Google Chrome prior to version 147.0.7727.55 are affected and should apply the update to prevent potential exploitation.

Vendor
Google
Product
Chrome
CVSS
MEDIUM 6.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of Google Chrome prior to version 147.0.7727.55 should apply the update to prevent potential exploitation of this vulnerability. This includes administrators and users of Chrome in managed environments, who should review and apply the necessary updates as part of their regular security practices. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential impact on their systems.

Technical summary

The vulnerability, CVE-2026-5892, exists in Google Chrome's handling of Progressive Web Apps (PWAs). An attacker who has compromised the renderer process can exploit this insufficient policy enforcement to install a PWA without user consent. This can be achieved through a specially crafted HTML page. The vulnerability has been rated as Medium severity with a CVSS score of 6.6. It is recommended that users update Google Chrome to version 147.0.7727.55 or later to mitigate this vulnerability.

Defensive priority

Medium priority due to the potential for exploitation by a compromised renderer process. It is recommended that users update Google Chrome to version 147.0.7727.55 or later to mitigate this vulnerability.

Recommended defensive actions

  • Update Google Chrome to version 147.0.7727.55 or later
  • Ensure that Chrome's auto-update feature is enabled
  • Monitor Chrome's version and update as necessary
  • Consider implementing additional security measures for PWA installations
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-04-08T22:16:29.083Z and last modified on 2026-07-24T08:10:00.150Z. The NVD entry is currently Analyzed. This vulnerability affects Google Chrome versions prior to 147.0.7727.55. The vulnerability has been rated as Medium severity with a CVSS score of 6.6. The CVE record was sourced from nvd_modified.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T22:16:29.083Z and has not been modified since then. The NVD entry is currently Analyzed.