CVE-2026-14138: Google Chrome XSS Vulnerability

CVE-2026-14138 Overview

CVE-2026-14138 is a user interface spoofing vulnerability in the WebAppInstalls component of Google Chrome on Windows. The flaw affects Chrome versions prior to 150.0.7871.47 and stems from an inappropriate implementation that permits a remote attacker to manipulate the install prompt through a crafted HTML page. Exploitation requires the victim to perform specific UI gestures, which raises attack complexity. The Chromium project rated the security severity as Low, and the issue maps to CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
An attacker can spoof UI elements in the Web App install flow, tricking users into installing or trusting content that appears to originate from a legitimate source.

Affected Products

Google Chrome on Windows prior to 150.0.7871.47
Microsoft Windows (host operating system)
Chromium-based WebAppInstalls component

Discovery Timeline

2026-06-30 - CVE-2026-14138 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-14138

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem of Chrome on Windows. This component handles the installation flow for Progressive Web Apps (PWAs) and browser-managed web applications. An inappropriate implementation allows a remote attacker who hosts a crafted HTML page to influence the visual presentation of install-related UI. The result is UI spoofing, where displayed origin, application name, or dialog content misleads the user about the true source of the content.

Because the confidentiality impact is none and integrity and availability impacts are low, the vulnerability does not directly expose sensitive data or crash the browser. Its risk is behavioral: a successful spoof can lead users to grant trust, install unwanted web apps, or take actions they would otherwise decline. Exploitation is gated by required user interaction and specific gesture sequences, which limits mass exploitation but remains viable in targeted phishing scenarios.

Root Cause

The root cause is an inappropriate implementation in the WebAppInstalls code path that fails to correctly represent or isolate attacker-controlled content within trusted UI surfaces. Under [CWE-451], such flaws occur when the browser renders origin or identity information in a way that an attacker can influence through page content or timing of user gestures.

Attack Vector

The attack vector is network-based and delivered through a crafted HTML page. A user must visit the attacker-controlled site and perform specific UI gestures for the spoof to succeed. Attackers typically pair this class of flaw with phishing lures or social engineering that guides the victim through the exact interaction sequence needed to trigger the misrepresentation.

No verified proof-of-concept code is publicly available for CVE-2026-14138. For technical details, refer to the Chromium Issue Tracker Entry and the Google Chrome Update Blog.

Detection Methods for CVE-2026-14138

Indicators of Compromise

Chrome browser processes on Windows running versions earlier than 150.0.7871.47.
Unexpected PWA or Web App install prompts appearing after users visit untrusted sites.
Newly registered web applications in the Chrome user profile that users do not recognize.

Detection Strategies

Inventory installed Chrome versions across the Windows fleet and flag hosts running builds prior to 150.0.7871.47.
Monitor endpoint telemetry for new entries under the Chrome Web Applications profile directory and correlate with browsing history to identify suspicious install origins.
Review proxy and DNS logs for domains hosting HTML pages associated with phishing campaigns that target Chrome install flows.

Monitoring Recommendations

Track Chrome update compliance through endpoint management tooling and enforce automatic updates.
Alert on creation of PWA shortcuts or launcher entries that originate from non-corporate domains.
Ingest browser and endpoint logs into a centralized analytics platform to correlate install events with user-reported phishing attempts.

How to Mitigate CVE-2026-14138

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 150.0.7871.47 or later.
Verify that Chrome auto-update policies are enabled and functioning across managed devices.
Educate users on verifying origins in install prompts and reporting unexpected Web App installation dialogs.

Patch Information

Google addressed CVE-2026-14138 in the Chrome Stable Channel update to version 150.0.7871.47 for desktop. Deployment details are documented in the Google Chrome Update Blog. Administrators managing Chrome through enterprise policies should confirm that the target version has propagated to all endpoints and that no update deferral policies are blocking installation.

Workarounds

Restrict Web App installation using the WebAppInstallForceList and DefaultWebAppInstallForce enterprise policies to allow only vetted applications.
Disable non-essential PWA install prompts through Chrome enterprise configuration where business requirements permit.
Route web traffic through a filtering proxy that blocks known phishing infrastructure to reduce exposure to crafted HTML pages.

bash

# Configuration example: enforce minimum Chrome version via Group Policy registry key on Windows
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "150.0.7871.47" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v WebAppInstallForceList /t REG_SZ /d "[]" /f