What is the CVSS score of CVE-2026-5892?

CVE-2026-5892 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-5892?

Yes, a patch is available for CVE-2026-5892. Update the affected software to the latest version immediately.

Google CVE-2026-5892

EUVD-2026-20711 MEDIUM

Policy Privileges are not Assigned Consistently Between Control and Data Agents (CWE-1268)

2026-04-08 Chrome

GHSA-x56m-fjh7-273x

Information Disclosure Google

6.6

CVSS 3.1 · Vendor: Chrome

Severity by source

Vendor (Chrome) PRIMARY

6.6 MEDIUM

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

SUSE

MEDIUM

qualitative

Red Hat

7.7 MEDIUM

qualitative

Primary rating from Vendor (Chrome).

CVSS VectorVendor: Chrome

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 15:26 vuln.today

CVSS changed

Apr 14, 2026 - 15:22 NVD

6.6 (MEDIUM)

Patch released

Apr 08, 2026 - 23:32 nvd

Patch available

EUVD ID Assigned

Apr 08, 2026 - 22:01 euvd

EUVD-2026-20711

CVE Published

Apr 08, 2026 - 21:20 nvd

N/A

DescriptionCVE.org

Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Chromium security severity: Medium)

AnalysisAI

Insufficient policy enforcement in PWA installation within Google Chrome prior to version 147.0.7727.55 allows a local attacker with renderer process compromise to install a Progressive Web App without user consent via a crafted HTML page. This vulnerability requires prior compromise of the renderer process and user interaction, resulting in high integrity and availability impact. The issue carries a low real-world exploitation probability (EPSS 0.03%), reflecting the significant prerequisites needed to trigger the vulnerability.

Technical ContextAI

Progressive Web Apps (PWAs) in Chromium-based browsers rely on policy enforcement mechanisms to validate user consent before installation. This vulnerability stems from insufficient validation of PWA installation policies when the renderer process is compromised. The underlying issue is classified as CWE-1268 (Improper Enforcement of Message Ordering in Communication Channel), indicating a breakdown in the trust boundary between the renderer and browser processes. The vulnerability affects Google Chrome on all platforms covered by the CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, meaning all architectures and configurations of Chrome versions prior to the patch.

RemediationAI

Update Google Chrome to version 147.0.7727.55 or later immediately. The vendor-released patch is available and should be deployed via the automatic update mechanism in Chrome, which prompts users to restart the browser to apply the fix. Users on managed environments should verify that Chrome updates are deployed across their estate. No known workarounds are available for users unable to patch immediately; instead, restrict access to untrusted websites and disable PWA installation from the Chrome settings (Settings > Apps > Install apps and extensions) as a temporary mitigation. Refer to the official Chrome Releases advisory at https://chromereleases.googleblog.com/2026/04/stable-channel-update-for-desktop.html for confirmation of patch availability.