EUVD-2026-50768
GHSA-j4f7-2v7w-hc88
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessVictim navigates to attacker-controlled page
-
DeliveryCrafted HTML triggers WebAppInstalls UI spoof
-
ExploitSpoofed install prompt presented as trusted Chrome dialog
-
ExecutionVictim actively interacts with prompt
-
ImpactMalicious PWA installed or unintended action authorized
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires a victim running Google Chrome prior to 151.0.7922.72 to visit an attacker-controlled webpage and actively interact with the spoofed UI element presented during the WebAppInstalls flow (confirmed by UI:R in the CVSS vector). No authentication, special server configuration, or non-default browser setting is required on the attacker's side. Exploitation is limited by: (1) mandatory user interaction - the victim must actively engage with the manipulated install prompt, preventing passive drive-by exploitation; (2) the attack surface is scoped to Chrome's PWA installation UI context, not general browser chrome; (3) no confidentiality or availability impact is possible through this flaw alone, constraining the attacker to integrity-based deception rather than data theft or system compromise; and (4) Chrome's auto-update mechanism reduces the window of exposure for users on supported platforms. |
| Impact | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N presents a nuanced risk profile: while attack complexity is low and no authentication is required, exploitation is gated on active user interaction (UI:R), which materially reduces mass-exploitation viability. The high integrity impact (I:H) reflects that successful spoofing can cause users to take consequential unintended actions - such as installing a malicious PWA or disclosing sensitive input - but the absence of confidentiality and availability impact means this is not a code-execution or data-exfiltration vector. EPSS at 0.17% (7th percentile) aligns with the low observed threat activity expected for a UI-spoofing flaw without a public exploit. No CISA KEV listing and no reported POC further confirm this is not under active mass exploitation. Risk prioritization: routine patching within normal Chrome update cycles is appropriate; emergency response is not warranted. The Chromium security severity is classified as Medium by Google, consistent with the independent signals. |
| Exploit ScenarioDerived | An attacker crafts a malicious HTML page that abuses Chrome's WebAppInstalls implementation to render a spoofed PWA installation prompt indistinguishable from a legitimate Chrome UI dialog. A victim browsing to the page and interacting with the fake prompt - for example, clicking an install button - could be manipulated into installing a malicious web application or authorizing an action under a false security context. No public proof-of-concept exploit is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.
RemediationAI
Update Google Chrome to version 151.0.7922.72 or later, the vendor-released patch confirmed by the Chrome Releases blog at http://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. The update is available through Chrome's built-in auto-update mechanism or manually via Help > About Google Chrome. Enterprise deployments managed via Google Admin Console or MDM solutions should push the policy-forced update to all managed endpoints promptly. No documented workarounds exist for this flaw; the patch is the sole confirmed remediation. As a limited compensating control pending upgrade, administrators may consider blocking access to unknown external sites via web proxy policy, though this does not eliminate risk for sites users are permitted to visit and is not a substitute for patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in Chrome's WebAppInstalls subsystem, which governs the Progressive Web App (PWA) installation prompt lifecycle - the browser chrome UI triggered when a site requests to be installed as a desktop or home-screen application. CWE-451 (User Interface Misrepresentation of Critical Information) identifies the root cause class: the implementation fails to enforce integrity of the installation UI surface, allowing an attacker-controlled page to manipulate or spoof the prompt in ways users cannot distinguish from legitimate browser UI. The affected product scope per CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome releases across platforms prior to the fixed version. The Chromium issue tracker entry (https://issues.chromium.org/issues/517487028) is the upstream defect record, though technical details may be restricted pending broader patch adoption.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Network-delivered via crafted page, no privileges required, but user must interact with spoofed UI; integrity-only impact as attacker manipulates perceived interface, not underlying data.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB