CVE-2026-14138: Chrome WebAppInstalls UI Spoofing Vulnerability – Patch Guidance

Technical summary

CVE-2026-14138 stems from inappropriate implementation in Chrome's WebAppInstalls component on Windows systems. The vulnerability enables UI spoofing attacks when a user performs specific UI interactions with a malicious HTML page. The attack vector is network-based with high attack complexity, meaning the attacker must craft the HTML carefully and the user must engage in particular gestures. The issue is classified under CWE-451 (User Interface (UI) Misrepresentation of Critical Information), indicating a flaw in how the application presents information to the user. This affects Chrome versions prior to 150.0.7871.47 on Windows.

Business impact

UI spoofing vulnerabilities can undermine user trust in browser security indicators and application authenticity. An attacker exploiting this flaw could present fraudulent install dialogs, permission prompts, or security warnings that appear legitimate, potentially tricking users into granting unintended permissions or installing unwanted applications. While the attack requires active user participation and careful social engineering, successful exploitation could lead to credential theft, malware installation, or unauthorized application installation on affected systems.

Affected systems

This vulnerability affects Google Chrome on Windows systems running versions prior to 150.0.7871.47. The WebAppInstalls feature is targeted specifically, which powers the capability to install web applications directly from Chrome. Both consumer and enterprise deployments of Chrome on Windows are potentially at risk, though users must interact with a malicious webpage in a particular way for exploitation to occur.

Exploitability

Exploitation requires network access and user interaction, placing this in the moderate exploitability range. The attacker must convince a user to visit a crafted HTML page and perform specific UI gestures—this is not a passive attack. The high attack complexity suggests that successful exploitation is not straightforward and depends on both technical precision in the malicious page and social engineering effectiveness. No public exploit code is known to be actively leveraged in the wild based on available evidence.

Remediation

Organizations and users should update Google Chrome to version 150.0.7871.47 or later on Windows systems. This patch addresses the underlying implementation flaw in WebAppInstalls. For enterprises managing Chrome deployments, policy-based updates should be prioritized. Additionally, user awareness training regarding suspicious install prompts and unexpected permission requests can reduce attack surface, given the user-interaction requirement.

Patch guidance

Apply Chrome version 150.0.7871.47 or any subsequent release to affected Windows systems. Chrome's automatic update mechanism will distribute the patch; verify deployment via chrome://settings/help or enterprise reporting tools. For managed environments, use Google Admin Console or equivalent mobile device management (MDM) solutions to enforce updates. No interim workarounds are necessary if updates are deployed promptly, though disabling WebApp installation features via policy is a temporary mitigation if patching is delayed.

Detection guidance

Monitor for unusual UI spoofing attempts by logging browser extension and website permission requests, particularly those related to app installation. Endpoint detection tools can flag suspicious HTML pages attempting to trigger WebAppInstalls dialogs with atypical parameters. Security teams should review user reports of unexpected install prompts or authentication dialogs that appear out of context. Network-level inspection of HTTP/HTTPS traffic to known malicious domains may catch delivery vectors, though the crafted HTML can be hosted anywhere.

Why prioritize this

While this vulnerability carries a CVSS score of 4.2 (Medium) and is not on the CISA KEV catalog, it merits timely remediation due to its reliance on user interface manipulation—a key attack surface for social engineering. The integrity and availability impacts, combined with the practical difficulty attackers face in reliable exploitation, position it as a standard-priority patch rather than critical-priority. Organizations with high-security postures and user awareness training may deprioritize slightly, but security-conscious deployments should still patch within normal update cycles.

Risk score, explained

The CVSS 3.1 score of 4.2 reflects a Medium severity assessment driven by: (1) network-based attack vector requiring no special privileges, (2) high attack complexity due to the need for precise social engineering and user interaction, (3) user interaction requirement that significantly raises the barrier to exploitation, and (4) limited impact scope—only integrity (ability to spoof UI) and availability (potential service disruption) are affected, with no confidentiality impact. The score appropriately discounts the theoretical risk given real-world exploitation difficulty.

Frequently asked questions