A vulnerability in Chrome’s handling of progressive web apps allows a remote attacker, who has already compromised the renderer process, to craft an HTML page that installs a PWA without prompting the user. The attacker can therefore add a malicious application to the user’s system, potentially used as a front for phishing, credential harvesting, or other malicious activity, without the user’s knowledge or approval.

Google Chrome installations older than version 147.0.7727.55 on any operating system are affected. Users of the stable desktop channel update that preceded the fix are at risk.

The CVSS score of 6.6 indicates medium severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires control over the renderer process, which arise from other memory corruption or cross‑site scripting issues; thus the attack vector is inferred to be an already compromised renderer rather than a direct remote user attack.