CVE-2026-14114: Chrome Android UI Spoofing Vulnerability

CVE-2026-14114 Overview

CVE-2026-14114 is a user interface (UI) spoofing vulnerability in the WebAppInstalls component of Google Chrome on Android. The flaw exists in versions prior to 150.0.7871.47 and stems from an inappropriate implementation that allows a local attacker to present misleading UI elements through a malicious file. Chromium rates the security severity as Low, while the CVSS 3.1 base score is 7.5 with a high integrity impact. The weakness maps to [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. Successful exploitation lets attackers manipulate what the user sees during a web app install prompt, potentially tricking victims into approving actions they would otherwise reject.

Critical Impact
Attackers can spoof the Chrome web app installation UI on Android, enabling social engineering that leads users to install or trust attacker-controlled content.

Affected Products

Google Chrome on Android prior to 150.0.7871.47
Chromium-based Android browsers sharing the WebAppInstalls component
Progressive Web App (PWA) install flows on affected Chrome builds

Discovery Timeline

2026-06-30 - CVE-2026-14114 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14114

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem of Chrome for Android. This component handles the installation prompts users see when adding a Progressive Web App or web-based shortcut to their device. The implementation does not adequately validate or constrain how attacker-supplied file content is rendered within the install UI. As a result, a local attacker can craft a malicious file that manipulates elements of the installation dialog. The CWE-451 classification identifies the core issue as misrepresentation of information the user relies on for a security decision. Because the spoof targets a trusted browser dialog, victims lack a reliable visual cue to distinguish legitimate installs from malicious ones.

Root Cause

The root cause is inappropriate implementation of input handling inside WebAppInstalls. Chrome does not properly separate attacker-controlled metadata from trusted chrome (browser-rendered) UI. This allows attacker-supplied strings, icons, or file references to overlap or overwrite security-relevant UI regions.

Attack Vector

Exploitation requires the attacker to deliver a malicious file to the target device and induce the user to open it in Chrome for Android. The file drives the WebAppInstalls flow, producing a deceptive install prompt. No authentication is required, and the CVSS vector indicates no user interaction is captured in the base score, though realistic exploitation relies on the victim engaging with the spoofed dialog. The impact is limited to integrity, with no direct disclosure of data or denial of service.

No verified public exploit code is available. See the Chromium Issue Tracker Entry and the Google Chrome Stable Update for vendor detail.

Detection Methods for CVE-2026-14114

Indicators of Compromise

Unexpected web app install prompts triggered immediately after opening a downloaded file in Chrome for Android
Installed PWAs with names, icons, or origins that do not match the domain the user intended to visit
Chrome for Android versions below 150.0.7871.47 present in mobile device management (MDM) inventory

Detection Strategies

Query mobile device inventories for Chrome for Android build numbers and flag any version earlier than 150.0.7871.47
Review PWA install telemetry from managed Android fleets for installs originating from local file URIs rather than HTTPS origins
Correlate file download events with subsequent WebAppInstalls activity to identify suspicious install chains

Monitoring Recommendations

Enroll Android endpoints in MDM or UEM tooling that reports installed browser versions and PWA inventory
Alert on Chrome versions that fall behind the current stable channel release
Monitor user reports of unexpected home-screen shortcuts or app icons appearing after browsing sessions

EPSS data as of 2026-07-02 places the exploitation probability at 0.158% (percentile 5.391), indicating low current in-the-wild activity, but detection should still be prioritized given the social engineering payoff.

How to Mitigate CVE-2026-14114

Immediate Actions Required

Update Google Chrome on Android to version 150.0.7871.47 or later through the Google Play Store
Push forced Chrome updates through MDM policies for managed Android fleets
Warn users against opening untrusted files directly in the Chrome browser on Android

Patch Information

Google addressed the vulnerability in the Chrome stable channel update covering versions at or above 150.0.7871.47. Details are published in the Google Chrome Stable Update release notes, with the underlying issue tracked in the Chromium Issue Tracker Entry. Verify update deployment by checking the browser build under Chrome settings on each device.

Workarounds

Disable or restrict Progressive Web App installation via Android enterprise policy where feasible
Configure browsers to block automatic opening of downloaded files in Chrome
Restrict which file types are allowed to be downloaded and opened on managed Android devices

bash

# Configuration example: enforce Chrome auto-update on managed Android devices via MDM policy
# Example policy keys (Android Enterprise managed configuration for Chrome)
DefaultBrowserSettingEnabled: true
WebAppInstallForceList: []            # do not force-install untrusted PWAs
DownloadRestrictions: 3                # block dangerous downloads
BrowserSignin: 1                       # ensure policies apply per-user