User installed application without admin credentials.

Basically, the title, I have no clue how this happened. They were able to bypass our edge polices by downloading a browser called Avast. It installed with no admin credentials. This is a major security risk for my organization. Is there something I am missing?