EUVD-2026-93617
GHSA-52r6-3x77-pjm4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessLure victim to crafted HTML page
-
ExploitTrigger misleading WebAppInstalls UI
-
ExecutionVictim approves spoofed install prompt
-
ImpactBypass intended access restriction
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V3 - Web Frontend Security UI security representation
|
| Exploitation Conditions | Exploitation requires the WebAppInstalls (Web App / PWA install) flow in Chrome and depends on active user interaction: the victim must visit an attacker-crafted HTML page and then approve the misrepresented install prompt (UI:R). It is remote and unauthenticated (PR:N, AV:N) but is gated by social engineering - no interaction, no exploit. Limiting factors: the user must both reach the malicious page and act on the deceptive UI, impact is confined to Low confidentiality/availability with no integrity loss, Chromium rates it Low severity, and all affected Chrome builds below 155.0.8059.39 are remediated by updating to that version. |
| Impact | This is a genuinely low-priority issue, and multiple signals agree. The CVSS 3.1 base score is 5.4 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L - network-reachable and unauthenticated (PR:N), but requiring user interaction (UI:R) and yielding only Low confidentiality and Low availability impact with no integrity impact. Google/Chromium itself rated the security severity 'Low'. This is a UI misrepresentation/spoofing flaw (CWE-451) in the WebAppInstalls surface, not a memory-corruption or code-execution bug, so the ceiling on damage is inherently limited. No EPSS score was provided in the input, no CISA KEV listing is present, and no public exploit code is indicated - so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between signals here: a low-impact spoofing bug that depends on social engineering is unlikely to be mass-exploited, and nothing in the data elevates it. Note that the 'Authentication Bypass' tag conflicts with the actual weakness class (CWE-451 UI misrepresentation); the description's phrase 'bypass system access restrictions' refers to tricking a user via a misleading install UI, not a true authentication bypass - verify tag against CWE. |
| Exploit ScenarioDerived | A remote attacker hosts a crafted HTML page and lures a victim to it through social engineering (phishing link, malicious ad, or compromised site). The page abuses the Web App install UI to misrepresent what is being installed or what access is granted, causing the user to approve an action they would otherwise reject. No public exploit code is identified at time of analysis, and success depends entirely on the victim interacting with the deceptive prompt. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
UI misrepresentation in Google Chrome's WebAppInstalls (progressive web app / web app install) flow in builds prior to 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions by luring a victim to a crafted HTML page and inducing them to approve a deceptive install prompt. The attack is entirely gated by user interaction and social engineering (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and availability and no integrity loss, and Google/Chromium rates the underlying issue Low security severity. No public exploit code was identified at time of analysis and the flaw is not confirmed as actively exploited (CISA KEV); this is a low-priority issue where patching is straightforward and the practical risk depends on user behaviour rather than on any remotely triggerable primitive.
RemediationAI
Vendor-released patch: update Google Chrome to 155.0.8059.39 or later, which is the fixed stable-channel revision referenced by the Chromium advisory at https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_086471744.html and the issue tracker entry https://issues.chromium.org/issues/533119681; because the CPE and EUVD data cover every Chrome build below that version on all platforms, the fastest and most complete fix is to force the update (chrome://settings/help, or managed auto-update via Chrome Browser Cloud Management / enterprise update policies) and then confirm the reported version is at least 155.0.8059.39, since a relaunch is required for the change to take effect. There is no configuration toggle that removes the social-engineering precondition - the exploit is entirely dependent on a user accepting a misleading install prompt - so interim compensating controls should target behaviour and exposure: enforce automatic updates so no endpoint lingers below the fixed build; block or filter access to untrusted/unclassified sites through existing URL filtering or secure web gateway policy, accepting that this reduces browsing reach and creates false positives; and require users to verify the site origin shown in any web app install prompt before approving it, acknowledging that user training is not a technical control and can be bypassed by convincing attacker content. No further vendor mitigation is required in the assessed impact range (Low confidentiality and availability, no integrity loss).
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is WebAppInstalls, the Chromium subsystem that renders the install prompts and dialogs used when a site offers itself as a Progressive Web App (PWA) or packaged web app. The root cause class is CWE-451 (User Interface (UI) Misrepresentation of Critical Information): the install UI failed to accurately represent security-relevant information - such as the true origin or the scope of access being granted - so the prompt could be made to look like something it was not, allowing the attacker to slip past restrictions the user believed were still in force. A crafted HTML page is sufficient to trigger the deceptive presentation, but nothing executes without the victim acting on the prompt, which is why the vector carries UI:R alongside AV:N/PR:N. The CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* corresponds to Chrome as a multi-platform product, so every supported desktop and mobile build below the fixed revision shares the defect; this is a Chromium-engine UI/trust issue rather than a memory-safety flaw (no RCE or sandbox escape is claimed by the assessed vector or by the Low Chromium severity rating), and integrity is unaffected (I:N).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Remotely reachable via crafted page (AV:N/AC:L/PR:N) but needs the user to act on a spoofed install prompt (UI:R); spoofing yields only Low C and A, no integrity impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB