This vulnerability in Chrome for Android (versions prior to 151) involves a flaw in the WebAppInstalls component — the system that handles Progressive Web App installation. The trigger mechanism is a crafted HTML page, which makes the CVE description's 'local attacker' framing highly suspect. If you can serve a malicious HTML page to a victim's browser, that's a remote attack vector regardless of what the advisory language claims. Treat this as a remote vulnerability until proven otherwise.
The attack surface worth scrutinizing is WebAppInstalls specifically. This component parses app manifests, writes to system-level locations, and registers installed applications with elevated privileges compared to standard web content. A cryptographic flaw in how manifests or associated assets are validated could allow an attacker to manipulate the installation process — not merely to run code in a browser tab, but to break out of the browser sandbox entirely by masquerading as a system-level installed application. This is the privilege escalation vector: the goal isn't web content injection, it's using the PWA installation flow as a sandbox escape mechanism.
Defensive priorities: First, verify your Chrome for Android version exposure — this affects versions prior to 151. Second, monitor for unusual PWA installation behavior on managed devices, particularly manifest fetches or app registration attempts initiated by untrusted web content. Third, given that the CVSS 6.1 likely understates the risk if a sandbox escape is genuinely achievable via single-page visit, consider elevating this in your prioritization logic beyond what the score alone would warrant. The EPSS score is low precisely because version 151 isn't released yet, but treat this as a forward-looking concern — the attack chain (HTML page → manifest parsing flaw → sandbox escape) maps cleanly onto existing mobile exploitation toolkits, meaning sophisticated actors could develop working exploits rapidly once the underlying flaw is understood from the patch.