CVE-2026-13993: Google Chrome XSS Vulnerability

CVE-2026-13993 Overview

CVE-2026-13993 is a security user interface (UI) flaw in the WebAppInstalls component of Google Chrome versions prior to 150.0.7871.47. The vulnerability falls under [CWE-451] (User Interface Misrepresentation of Critical Information). A remote attacker who convinces a user to perform specific UI gestures can spoof a domain through a crafted HTML page. This weakness enables convincing phishing scenarios by displaying misleading origin information in the web app installation flow. Chromium rates the security severity as Medium, and the flaw affects Chrome across Windows, macOS, and Linux desktop platforms.

Critical Impact
Attackers can spoof legitimate domains during Progressive Web App installation, tricking users into installing attacker-controlled web applications that appear to originate from trusted sources.

Affected Products

Google Chrome prior to 150.0.7871.47 on Microsoft Windows
Google Chrome prior to 150.0.7871.47 on Apple macOS
Google Chrome prior to 150.0.7871.47 on Linux

Discovery Timeline

2026-06-30 - CVE-2026-13993 published to the National Vulnerability Database (NVD)
2026-07-01 - CVE-2026-13993 last modified in NVD database

Technical Details for CVE-2026-13993

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem, which handles the installation of Progressive Web Applications (PWAs) initiated from web content. The UI presented during the installation flow does not correctly convey the true origin of the application to the user. An attacker who lures a user to a crafted HTML page and coaxes them into completing a sequence of UI gestures can cause the install dialog to display a spoofed domain. This misrepresentation defeats a key trust boundary that users rely on when deciding whether to install a web application.

User interaction is required, and the attack complexity is high because the adversary must engineer both the malicious page and the specific gesture sequence. Successful exploitation impacts integrity and availability at a limited level, since the spoofed app can persist as an installed application launcher on the operating system.

Root Cause

The root cause is improper origin representation in the WebAppInstalls confirmation UI. Chrome renders installation prompts using data influenced by the calling page rather than exclusively from the security-relevant top-level origin. Under specific UI gesture sequences, the browser presents a domain string that does not match the actual origin serving the install request, allowing spoofing.

Attack Vector

Exploitation begins with the attacker hosting a crafted HTML page on an attacker-controlled server. The victim visits the page, typically via a phishing link. The page uses scripted DOM interactions combined with prompts that require the victim to perform specific gestures such as clicks, drags, or menu selections. These gestures trigger the WebAppInstalls flow while the UI still reflects an incorrect domain, resulting in the installation of an attacker-controlled PWA that appears to originate from a trusted brand.

No verified public proof-of-concept code is available. Refer to the Chromium Issue Tracker Entry for technical details.

Detection Methods for CVE-2026-13993

Indicators of Compromise

Presence of installed PWAs in the Chrome profile under Web Applications directories that do not correspond to legitimately visited business domains.
Newly created desktop or Start menu shortcuts pointing to chrome_proxy.exe --app-id= with unfamiliar application identifiers.
Browser history entries showing user navigation to low-reputation domains immediately preceding a web app install event.

Detection Strategies

Inventory installed Chrome PWAs across managed endpoints and compare application identifiers against an approved allowlist.
Hunt for Chrome shortcut creation events referencing --app-id command-line arguments generated shortly after browsing sessions to uncategorized domains.
Correlate outbound DNS and HTTP telemetry with Chrome PWA launches to identify installed apps beaconing to attacker infrastructure.

Monitoring Recommendations

Monitor endpoint process creation for chrome.exe invocations that spawn --app-id launches without an equivalent record of user-approved install.
Ingest browser telemetry into a centralized data lake and alert on Chrome versions below 150.0.7871.47 observed in the environment.
Track user reports of unexpected desktop shortcuts or installed web applications as a leading indicator of successful spoofing attacks.

How to Mitigate CVE-2026-13993

Immediate Actions Required

Update Google Chrome to version 150.0.7871.47 or later on all Windows, macOS, and Linux endpoints.
Enforce automatic Chrome updates through enterprise policy to ensure patched versions are rolled out without user intervention.
Audit installed PWAs across the fleet and remove any web applications that cannot be tied to an approved business use case.

Patch Information

Google released the fix in the Chrome Stable channel as documented in the Google Chrome Stable Update. Administrators should confirm that endpoints report Chrome 150.0.7871.47 or higher. The underlying code change is tracked in the Chromium Issue Tracker Entry.

Workarounds

Disable web app installation via the WebAppInstallForceList and DefaultWebAppInstallation enterprise policies until patching is complete.
Restrict PWA installations to a curated allowlist of internal and approved external origins using Chrome Enterprise policies.
Deliver targeted user awareness guidance warning against completing install prompts triggered by unsolicited pages or unusual gesture requests.

bash

# Example Chrome Enterprise policy (Windows registry) to block user-initiated web app installs
reg add "HKLM\Software\Policies\Google\Chrome" /v WebAppInstallForceList /t REG_SZ /d "[]" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebAppInstallation /t REG_SZ /d "block" /f