Insufficient enforcement of policy within the progressive web app subsystem of Google Chrome allows an attacker who has already compromised the renderer process to bypass user confirmation and install a progressive web app through a crafted HTML page. The installed app can then run with the privileges of the user’s profile, enabling disclosure or modification of local data and potentially acting as a vector for further exploitation. The weakness is a form of improper access control, identified as CWE‑284.

All desktop installations of Google Chrome older than version 147.0.7727.55 are affected. This includes Windows, macOS, and Linux builds of the stable channel. The vendor’s update notes confirm that the patch applies universally across these platforms.

Chromium classifies the vulnerability as medium severity. Exploitation requires the attacker to first compromise the renderer process, typically through a separate web‑based exploit that gains sufficient access. Until the browser is updated, the likelihood of successful exploitation remains low, but the impact, if achieved, could be significant for the compromised user. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog, and no EPSS score is available.