CVE-2026-14114: Chrome Android UI Spoofing Flaw in WebAppInstalls

Technical summary

CVE-2026-14114 stems from improper input validation or state management in Chrome's WebAppInstalls implementation on Android. The vulnerability allows a local attacker to supply a malicious file that causes the browser to render UI elements that do not accurately represent the true state of an installation or permission. This falls under CWE-451 (User Interface Inconsistency), where the presented interface differs from the actual backend state. The attack vector is network-level in the CVSS model, but in practice requires local file access to trigger the malicious payload. Affected versions are Chrome on Android builds prior to 150.0.7871.47.

Business impact

UI spoofing attacks can lead to users granting permissions they did not intend to grant, installing untrusted web apps, or believing they have completed security actions when they have not. For organizations managing Android devices with Chrome as the primary browser, this could result in unauthorized app installations, data exfiltration through deceptive app prompts, or credential theft if users are tricked into entering sensitive information into a spoofed login interface. The reputational risk is moderate if users conflate browser security with the organization's security posture.

Affected systems

Google Chrome on Android prior to version 150.0.7871.47 is vulnerable. This includes all point releases and build variants below 150.0.7871.47. Android devices running these Chrome versions, particularly those in enterprise or educational environments where web app installation is permitted, are in scope. Desktop Chrome and Chrome on other platforms are not affected by this specific CVE.

Exploitability

Exploitation requires local access to the target device and the ability to place or direct the user to open a malicious file. This is not a remote code execution or wormable vulnerability. The attacker relies on social engineering or preexisting device compromise. Public exploit code has not been added to the Known Exploited Vulnerabilities (KEV) catalog, and no active exploitation has been publicly reported as of the vulnerability publication date. The barrier to exploitation is moderate—an attacker must craft a specific malicious file and either trick a user into opening it or have prior device access.

Remediation

Update Google Chrome on Android to version 150.0.7871.47 or later. This is a straightforward patch deployment via the Google Play Store or managed device deployment tools. No workarounds exist for the underlying implementation flaw, so updating is mandatory for full mitigation. Organizations using mobile device management (MDM) solutions can enforce automated Chrome updates to ensure timely remediation.

Patch guidance

Verify that your Android devices are running Chrome version 150.0.7871.47 or higher. Users can check the version in Chrome Settings > About Chrome, which will automatically update if a newer version is available. For enterprise deployments, use your MDM solution to push the update to all managed devices. There is no configuration change or security policy adjustment needed once the patch is applied. Prioritize devices with web app installation features enabled in your organizational policies.

Detection guidance

Monitor for unusual web app installation attempts or user complaints about unexpected permission prompts. On the device level, look for failed or suspicious app installation logs in the Chrome cache or Android package manager logs. If you operate a Mobile Threat Defense (MTD) solution, configure it to flag suspicious file placements in the downloads directory or unusual Chrome process behavior. Network-level detection is limited because the malicious file must be local; focus on endpoint telemetry. Review user reports of confusing or misaligned Chrome UI prompts as a potential early indicator.

Why prioritize this

Although Google's security team assigned this a 'Low' severity rating, the CVSS 3.1 score of 7.5 (HIGH) reflects the potential for integrity compromise through UI spoofing. Prioritize this patch for devices that support web app installation and are in higher-risk user populations (e.g., those handling sensitive data or customer interactions). For general consumer and standard enterprise deployments, this is a medium-priority update; however, it should not be deferred indefinitely. The lack of KEV designation and public exploit code means active threat is lower than the CVSS might suggest, but the mechanism (social engineering via UI deception) is reliable if the malicious file reaches a user.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) is driven by a high integrity impact (I:H), no authentication requirement (PR:N), and a network attack vector (AV:N). However, this assessment assumes the malicious file can be delivered and executed on the local device, which narrows the practical attack surface. The Chromium team's 'Low' designation reflects the local access requirement and reliance on user interaction. The gap between CVSS and Chromium severity is common for social engineering attacks: CVSS models the technical impact abstractly, while Chromium's severity accounts for real-world exploitability constraints.

Frequently asked questions