EUVD-2026-40818
GHSA-9gwh-j3gj-52pq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Renderer compromise prerequisite raises AC to H; UI spoofing yields only C:L/I:L with no availability impact and no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
AnalysisAI
UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.
Technical ContextAI
The flaw is rooted in CWE-20 (Improper Input Validation) within Chrome's WebAppInstalls subsystem, which handles Progressive Web App (PWA) installation flows and associated UI dialogs. Google Chrome's multi-process architecture isolates web content in sandboxed renderer processes; however, if a renderer is already compromised via a separate vulnerability, insufficient validation in WebAppInstalls allows attacker-controlled renderer content to influence installation-related UI surfaces. The affected CPE (cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*) covers all Chrome desktop platform variants prior to version 150.0.7871.47. The Chromium security team rated this Low severity, reflecting the meaningful barrier imposed by the renderer compromise prerequisite within Chrome's defense-in-depth model.
RemediationAI
Upgrade Google Chrome to version 150.0.7871.47 or later; this is confirmed as the vendor-released patched build per the Stable channel advisory at https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0175352312.html. Chrome typically auto-updates, so ensure auto-update is enabled and prompt users to relaunch the browser to apply the update. Because exploitation requires a compromised renderer as a precondition, organizations should also prioritize patching any other Chrome renderer-level vulnerabilities (especially high-severity RCE issues in the same release cycle), as those represent the true attack entry point that enables this flaw to be reached. No documented workarounds exist specifically for this issue; disabling PWA/WebApp installation via enterprise policy (WebAppInstallForceList or related Chrome policies) could eliminate the attack surface as a compensating control, with the trade-off of blocking legitimate PWA deployments for users.
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Tumbleweed | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today