CVE-2020-6536: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-6536 is a security vulnerability discovered in Google Chrome versions prior to 84.0.4147.89. The vulnerability involves incorrect security UI implementation in Progressive Web Apps (PWAs) that allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted PWA, but only after persuading the user to install the malicious PWA (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited remotely, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, and it can lead to low impact on integrity with no impact on confidentiality or availability (NVD).

The vulnerability allows attackers to spoof the contents of the Omnibox (URL bar) in Progressive Web Apps, potentially misleading users about the website they are interacting with. This could be used in phishing attacks or other social engineering attempts to deceive users about the authenticity of a web application (NVD).

The vulnerability requires user interaction in the form of installing a malicious PWA. The attacker must first persuade the user to install the crafted PWA before the URL spoofing can occur (Chrome Release).

The vulnerability was patched in Google Chrome version 84.0.4147.89. Users and organizations are advised to upgrade to this version or later to mitigate the risk. The fix has been distributed to various Linux distributions including Fedora, Debian, and OpenSUSE through their respective security updates (Gentoo Security).