CVE-2026-14381: Chrome WebAppInstalls UI Spoofing Vulnerability (v150)

Technical summary

CVE-2026-14381 is a UI spoofing vulnerability affecting Chrome's WebAppInstalls feature. The root cause stems from incorrect security UI rendering, classified under CWE-290 (Improper Input Validation) and CWE-451 (User Interface (UI) Misrepresentation of Critical Information). An attacker crafts malicious HTML that exploits how Chrome renders or displays security-related UI elements during the web app installation flow. The attack vector is network-based with low complexity; the user must interact with the malicious page (e.g., click an install prompt or button) for the spoofing to take effect. The vulnerability carries a CVSS 3.1 score of 6.5 (Medium severity) with high integrity impact but no confidentiality or availability impact.

Business impact

This vulnerability primarily threatens user trust and application integrity. Attackers could trick employees or customers into installing counterfeit web apps that mimic legitimate services, potentially leading to credential theft, data exfiltration, or further social engineering. For enterprises deploying Progressive Web Apps (PWAs) or relying on web-based application distribution, this increases the attack surface for internal users. The reputational risk is secondary but meaningful: if users are deceived into installing fake apps via spoofed Chrome prompts, confidence in the organization's digital distribution channel erodes.

Affected systems

Google Chrome versions prior to version 150.0.7871.46 are affected. This includes all supported and legacy Chrome releases that fall below this threshold across Windows, macOS, Linux, Android, and iOS platforms. Users who have auto-update enabled should receive the patch automatically; those on manual update cycles must upgrade explicitly. Enterprise deployments pinned to older Chrome versions remain vulnerable until updated. Chrome-based browsers and derivatives that ship the affected Chromium code (before the fix was integrated upstream) may also be impacted.

Exploitability

Exploitation requires delivery of a specially crafted HTML page to the victim, typically via phishing, malvertising, or a compromised web server. The attacker cannot exploit the vulnerability silently; the user must interact with the spoofed UI (e.g., proceed with an install action). This human element raises the bar for mass exploitation but does not meaningfully reduce risk in targeted scenarios. No public exploit code or active in-the-wild attacks are documented in the KEV catalog. However, the attack requires no special privileges, can be launched over the network, and relies only on a user's normal browsing behavior, making it a moderate-difficulty social engineering vector.

Remediation

Update Google Chrome to version 150.0.7871.46 or later. For Windows and macOS, users can navigate to Chrome > Settings > About to trigger automatic update checks. Linux users should update via their package manager. Enterprise administrators should verify patch deployment across managed Chrome instances. For organizations using Chrome Fleet Management or similar tools, centralized rollout is recommended. Verify successful upgrade by confirming the version number in chrome://version.

Patch guidance

Apply Chrome version 150.0.7871.46 or any subsequent release. No interim mitigations are necessary once the patch is deployed. If your environment has Chrome update management policies, ensure policies permit this update or manually schedule a deployment window. For devices on auto-update, no action is typically required beyond standard browser restart workflows. Confirm patch application by auditing version telemetry across your managed Chrome fleet.

Detection guidance

Monitor for suspicious WebAppInstalls flows in user sessions—look for unexpected or out-of-band web app installation prompts, especially those requesting elevated permissions. Endpoint Detection and Response (EDR) tools can track chrome.exe process behavior during PWA install operations. Network-layer detection is limited since the exploit uses legitimate Chrome functionality; focus on user reports of fake install prompts or suspicious web app installations. Encourage users to verify app sources before approving install prompts and to report visually unusual security dialogs.

Why prioritize this

Although marked as Medium severity, this vulnerability should be prioritized for rapid patching in organizations where users regularly interact with web applications or PWAs. The UI spoofing mechanism is particularly effective in enterprise environments relying on web-based SaaS tools, as attackers can craft prompts that closely mimic legitimate corporate application distribution. The requirement for user interaction does not significantly lower risk in social engineering-heavy attack scenarios. Early patching reduces the window in which employees can be deceived.

Risk score, explained

The CVSS 6.5 (Medium) score reflects high integrity impact (attackers can trick users into installing fake apps) balanced against the user interaction requirement and network-based attack vector. Confidentiality and availability are not directly impacted, which prevents a higher score. However, the practical risk is elevated in environments with security-conscious users or highly targeted phishing campaigns, as the spoofed UI is difficult for non-technical users to distinguish from legitimate Chrome prompts.

Frequently asked questions