CVE-2026-14131 Overview
CVE-2026-14131 is an input validation vulnerability [CWE-20] in the WebAppInstalls component of Google Chrome versions prior to 150.0.7871.47. The flaw allows a remote attacker who has already compromised the renderer process to perform user interface (UI) spoofing through a crafted HTML page. Successful exploitation requires user interaction and depends on prior compromise of the renderer sandbox. Chromium's security team classified the underlying issue as Low severity, while the NVD assigns a CVSS 3.1 score of 5.4.
Critical Impact
An attacker with a compromised renderer process can spoof the Web App installation UI, potentially tricking users into installing or trusting attacker-controlled applications.
Affected Products
- Google Chrome versions prior to 150.0.7871.47
- Chromium-based browsers incorporating the vulnerable WebAppInstalls component
- Desktop channels (Windows, macOS, Linux) receiving the Stable channel update
Discovery Timeline
- 2026-06-30 - CVE-2026-14131 published to NVD
- 2026-07-01 - Last updated in NVD database
Technical Details for CVE-2026-14131
Vulnerability Analysis
The vulnerability resides in Chrome's WebAppInstalls subsystem, which handles Progressive Web App (PWA) installation prompts and related UI surfaces. The component fails to sufficiently validate untrusted input supplied through a crafted HTML page. An attacker who has already compromised the renderer process can leverage this weakness to manipulate the installation UI presented to the user.
The vulnerability is scoped to UI spoofing rather than direct code execution. Impact centers on user deception: an attacker can misrepresent the origin, name, icon, or metadata of a web app installation prompt. This creates conditions for phishing, credential theft, or persistence via installed PWAs that appear legitimate.
The issue is classified as Improper Input Validation [CWE-20]. Exploitation requires user interaction (UI:R) and network delivery of the crafted page, and does not require privileges beyond a compromised renderer.
Root Cause
The WebAppInstalls code path accepts input originating from the renderer without applying adequate sanitization or validation before rendering it in privileged browser UI. Because the renderer is treated as untrusted in Chrome's security model, any data crossing the renderer-browser boundary must be validated. The missing checks allow attacker-controlled values to influence UI elements users rely on to make trust decisions.
Attack Vector
Exploitation follows a two-stage chain. First, the attacker must compromise the renderer process, typically through a separate memory corruption or logic bug. Second, from within the compromised renderer, the attacker serves a crafted HTML page that triggers a Web App installation flow with manipulated content. The user sees a spoofed installation dialog and may authorize installation of what appears to be a trusted application.
No verified public proof-of-concept code is available. Technical details are tracked in the Chromium Issue Tracker Entry and the Google Chrome Desktop Update advisory.
Detection Methods for CVE-2026-14131
Indicators of Compromise
- Chrome installations reporting a version string lower than 150.0.7871.47 in enterprise inventory data
- Unexpected PWA entries under user profiles in %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Applications\
- Browser process telemetry showing renderer crashes or sandbox escapes preceding PWA installation events
- Installed web apps referencing domains that do not match the visible name or icon presented at install time
Detection Strategies
- Inventory Chrome versions across managed endpoints and flag any build below 150.0.7871.47
- Monitor creation of new Web App shortcuts and manifest files on user endpoints for unexpected installations
- Correlate renderer process anomalies with subsequent PWA installation activity within a short time window
- Review browser management console logs for install prompts originating from low-reputation domains
Monitoring Recommendations
- Enable Chrome Enterprise reporting to surface browser version and installed extension or PWA telemetry
- Alert on PWA installation events tied to newly registered or uncategorized domains
- Track user reports of misleading install prompts or apps that behave differently than expected after installation
How to Mitigate CVE-2026-14131
Immediate Actions Required
- Update Google Chrome to version 150.0.7871.47 or later on all managed endpoints
- Force restart of Chrome processes after deployment to ensure the patched binary is loaded
- Audit installed Progressive Web Apps for entries created before patch deployment and remove any that appear suspicious
- Communicate to end users that installation prompts should be scrutinized and cancelled if the source is unclear
Patch Information
Google addressed the vulnerability in Chrome Stable channel version 150.0.7871.47. Details are published in the Google Chrome Desktop Update release notes. Chromium-based browser vendors should incorporate the corresponding upstream fix.
Workarounds
- Disable Web App installation via the WebAppInstallForceList and related Chrome enterprise policies where PWAs are not required
- Restrict installation of Progressive Web Apps to an allowlist of approved domains using WebAppSettings
- Enforce automatic Chrome updates through Google Update policies to minimize exposure windows
# Configuration example: Chrome enterprise policy to block PWA installs (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebAppsInstallation /t REG_DWORD /d 2 /f
# Force minimum Chrome version via policy
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.47" /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
