EUVD-2026-93630
GHSA-hmwg-4f8h-mxc7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger WebAppInstalls authorization flaw
-
ExecutionSpoof browser UI elements
-
ImpactDeceive user into trusting falsified prompt
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to actively navigate to an attacker-crafted HTML page (UI:R in the CVSS vector), making user interaction a hard prerequisite - this cannot be triggered passively or server-side. The flaw is specific to the WebAppInstalls component of Chrome (desktop stable channel prior to 155.0.8059.39), so it is relevant only where the web-app install surface is reachable. The impact is limited to spoofing UI elements rather than executing code or stealing data, which materially constrains real-world harm to social-engineering/phishing assistance. No authentication is required of the attacker, but no sensitive operation occurs without user deception. |
| Impact | This is a genuinely low-priority issue despite the medium CVSS base score of 5.4. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) indicates remote, unauthenticated exploitation but critically requires user interaction (UI:R) - the victim must visit an attacker-controlled page. Google's own Chromium severity rating is 'Low', which aligns with the nature of the flaw: UI spoofing rather than code execution, data theft, or sandbox escape. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept was referenced, so there is no evidence of exploitation pressure. The signals are consistent rather than conflicting: a browser UI-spoofing bug with mandatory user interaction and no known exploitation. Note a minor internal inconsistency - the input CVSS assigns C:L/I:N/A:L, yet a UI-spoofing/incorrect-authorization defect maps more naturally to an integrity impact (misleading the user) than to confidentiality or availability; this does not change the overall low-priority conclusion. Patch within normal cadence rather than treating as an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that abuses the WebAppInstalls incorrect-authorization flaw to spoof browser UI elements (such as an installation prompt or origin indicator). A victim who is lured into visiting the page sees falsified UI chrome, which could be leveraged for phishing or to trick the user into installing or trusting content. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
UI spoofing in Google Chrome's WebAppInstalls component lets a remote, unauthenticated attacker mislead a victim with fabricated install-related browser UI on desktop builds prior to 155.0.8059.39. The root cause is incorrect authorization (CWE-863) in the web-app installation surface, and because the CVSS vector requires UI:R, the victim must actively navigate to an attacker-crafted HTML page before anything happens - so the realistic outcome is assistance to phishing or social engineering rather than code execution or credential theft. Chromium rates this Low severity (NVD base 5.4), our independent assessment further narrows the impact to low integrity only, there is no KEV listing indicating confirmed active exploitation, and no public exploit code has been identified at time of analysis.
RemediationAI
Vendor-released patch: Chrome 155.0.8059.39 - upgrade to that build or later via the browser's built-in updater (chrome://settings/help) or by pushing the current stable package through enterprise software distribution, reusing the same mechanism as the October stable channel release described at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html (tracked upstream as Chromium issue 553269860). No server-side or network control mitigates this, since the flaw is entirely in the client. If immediate fleet-wide update is not possible, the only meaningful compensating control is to shrink the attack surface by using Chrome Enterprise policies that govern whether users may install web apps / PWAs (disabling or restricting the web-app install surface), with the trade-off that legitimate PWA deployment and shortcut creation break for affected users; auxiliary measures such as user awareness training about install prompts are weak and should not be treated as a substitute for patching, and blocking the feature should be lifted once 155.0.8059.39 or later is deployed. Given the Low Chromium severity rating and the user-interaction requirement, this should be handled within the normal Chrome update cadence rather than as an emergency change.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WebAppInstalls is the Chromium subsystem that handles Progressive Web App / web-app installation on the browser side, including the install prompt, generated shortcut and icon presentation, and associated permission and origin checks. The assigned weakness, CWE-863 (Incorrect Authorization), indicates that this component failed to properly verify that the requesting context was authorized to drive install-related UI, allowing a crafted page to render or substitute UI elements that the browser should have reserved for trusted, browser-controlled surfaces. The supplied CPE, cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, is a wildcard that matches every Chrome release below the fixed build rather than a single version, so all desktop Chrome versions prior to 155.0.8059.39 carry the condition. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U) confirms the attack is network-delivered and needs no attacker credentials, but user interaction is a hard prerequisite; our independent assessment of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N limits the consequence to low integrity impact, i.e. a spoofed UI state rather than disclosed data, modified data, or denial of service. This is a cross-origin UI-spoofing class of issue, and the low severity assigned by Chromium reflects that it cannot be triggered passively or server-side.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Victim must visit a crafted page (UI:R) and the defect only spoofs UI elements, a display-integrity issue (I:L), with no confidentiality or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Incorrect authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB