CVE-2026-13993: Google Chrome WebAppInstalls UI Spoofing Vulnerability (CVSS 4.2)

Technical summary

CVE-2026-13993 is classified as a user interface (UI) spoofing vulnerability stemming from improper security UI rendering in Chrome's WebAppInstalls feature. The root cause is traced to CWE-451 (User Interface (UI) Misrepresentation of Critical Information), where the browser fails to correctly represent or validate domain information during web app installation flows. The vulnerability has a CVSS 3.1 score of 4.2 (Medium severity) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L, indicating network attack surface, high attack complexity, required user interaction, and limited integrity and availability impact. The flaw exists in versions of Chrome prior to 150.0.7871.47 and affects multiple operating systems through Chrome's cross-platform codebase.

Business impact

This vulnerability poses a moderate but meaningful risk to user trust and organizational security posture. While the direct technical impact is limited—no remote code execution, no session hijacking—the ability to perform domain spoofing can lead to credential theft, phishing success rates, or installation of malicious web apps masquerading as legitimate services. Organizations with users who install web apps from untrusted sources or those managing Chrome fleet deployments face elevated risk of social engineering attacks. The requirement for specific user gestures means attackers must craft convincing social engineering to succeed, but motivated threat actors can do this at scale through compromised advertisements or malicious sites. The Medium severity rating reflects that this is a concern requiring prompt attention but not an emergency-level incident.

Affected systems

The vulnerability affects Google Chrome on multiple operating systems: Windows, macOS, and Linux systems running Chrome versions prior to 150.0.7871.47. The underlying Chromium codebase affects all platforms equally. Organizations should assume that any Chrome deployment below version 150.0.7871.47 on Windows, macOS, or Linux is affected. This includes both standalone Chrome installations and Chrome bundled with other applications or managed through enterprise deployment tools. Chromium-based browsers derived from vulnerable Chromium versions may also be affected, though the severity and exploitability may vary depending on how they implement WebAppInstalls features.

Exploitability

Exploitation requires a remote attacker to craft a malicious HTML page and convince a user to visit it, then interact with specific UI elements in a particular sequence. The attack complexity is rated as High, meaning the attacker must either understand or predict the exact user gestures needed, or the user must be highly susceptible to social engineering. The attack does not require authentication, special network positioning, or privileges. Real-world exploitation is plausible but not trivial; attackers would likely combine this with social engineering, compromised ad networks, or targeting users already predisposed to installing web apps. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, suggesting no widespread active exploitation has been publicly documented at time of publication, though this does not guarantee exploit code does not exist in the wild.

Remediation

The primary remediation is to update Google Chrome to version 150.0.7871.47 or later. This patch corrects the security UI rendering logic in the WebAppInstalls feature and ensures domain information is accurately represented to users. For organization-wide Chrome deployments, use enterprise update channels (Chrome Enterprise, Chrome Browser Cloud Management, or mobile device management solutions) to force timely patching. Verify patch deployment through Chrome://version checks or MDM compliance reports. In the interim, user education about verifying domain names before installing web apps, avoiding web app installations from untrusted sources, and recognizing spoofing attempts can reduce risk. No workarounds or mitigation settings exist within Chrome itself.

Patch guidance

Update Chrome to version 150.0.7871.47 or later using Chrome's standard auto-update mechanism, which typically checks for updates every few hours. To force an immediate check, navigate to chrome://settings/help, which will display the current version and initiate an update if available. For enterprise deployments on Windows, use Group Policy or the Chrome Enterprise bundle to push version 150.0.7871.47 or later. For macOS, deploy through enterprise channels or standard package managers (Homebrew, Jamf, etc.). For Linux, update through the system package manager or verify the latest version is installed via the official Chrome repository. Test the patch in a non-production environment first if critical workflows depend on Chrome stability. Verify successful patching by confirming the version matches 150.0.7871.47 or a later release across all systems.

Detection guidance

Detection of exploitation attempts is challenging since the attack occurs within the browser UI and does not generate network anomalies. Monitor for indicators of compromise including: (1) unusual web app installations on user systems, particularly from unfamiliar or newly created domains; (2) user reports of unexpected prompts or confusing security warnings during web app installation; (3) spikes in failed login attempts to organizational services, which may indicate credential harvesting via spoofed domain installations; (4) DNS or proxy logs showing access to domain names similar to trusted organizational domains (typosquatting patterns). Implement application whitelisting or app control policies to restrict unauthorized web app installations. Review browser history for visits to suspicious domains around the time of user complaints. Educate end users to report unusual installation prompts or unclear domain names during web app setup.

Why prioritize this

This vulnerability warrants standard prioritization (patch within 1–2 weeks for most organizations) rather than emergency response. The Medium CVSS score, high attack complexity, required user interaction, and absence of active exploitation in KEV reflect a real but not imminent threat. However, prioritization should increase if your organization has users who frequently install web apps, operates in a high-phishing-risk environment, or manages sensitive workflows via web apps. Prioritize patches for systems used by high-value targets (executives, finance teams) who may be social engineering targets, and for public-facing or customer-service roles where domain spoofing could cause reputational harm. Standard desktop and developer deployments can follow normal patch cycles.

Risk score, explained

The CVSS 3.1 score of 4.2 (Medium) reflects the combination of: (1) network attack surface (AV:N) with no special positioning required; (2) high attack complexity (AC:H), requiring specific user gestures and effective social engineering; (3) mandatory user interaction (UI:R), making mass exploitation difficult; (4) unchanged scope (S:U), affecting only the Chrome user's session; (5) low confidentiality impact (C:N), since no data is exfiltrated; and (6) low integrity (I:L) and availability impact (A:L), limited to UI deception and potential web app misinstallation rather than data loss or system failure. The score appropriately reflects that this is a non-critical but meaningful security flaw requiring patching but not emergency response. The lack of remote code execution or direct data theft prevents a higher score.

Frequently asked questions