CVE-2026-14381: Google Chrome XSS Vulnerability

CVE-2026-14381 Overview

CVE-2026-14381 is a user interface spoofing vulnerability in the WebAppInstalls component of Google Chrome. The flaw affects Chrome versions prior to 150.0.7871.46 and stems from incorrect security UI handling during web application installation prompts. A remote attacker can exploit the issue by serving a crafted HTML page that manipulates the install dialog to misrepresent origin or content details. Google's Chromium team classified this as Medium severity. The vulnerability falls under the User Interface Confusion category and enables phishing-style deception rather than direct code execution.

Critical Impact
Remote attackers can spoof the Chrome web app install UI to deceive users into installing attacker-controlled applications that appear to originate from trusted sources.

Affected Products

Google Chrome Desktop versions prior to 150.0.7871.46
Chromium-based browsers incorporating the vulnerable WebAppInstalls component
All operating systems supported by Chrome Stable channel (Windows, macOS, Linux)

Discovery Timeline

2026-07-01 - CVE-2026-14381 published to the National Vulnerability Database
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-14381

Vulnerability Analysis

The vulnerability resides in the WebAppInstalls subsystem, which handles installation prompts for Progressive Web Applications (PWAs) and web apps. Chrome presents users with a native-looking dialog showing the app name, icon, and origin before installation completes. When this dialog renders content derived from attacker-controlled HTML, incorrect security UI logic allows the visual representation to deviate from the true origin.

An attacker hosting a crafted HTML page can influence the install prompt so users see misleading identity information. The result is a spoofing primitive that undermines the trust boundary between the browser chrome and web content. While the flaw does not grant code execution, it directly enables social engineering and credential phishing scenarios by exploiting user trust in browser-rendered security indicators.

Root Cause

The root cause is improper validation or sanitization of metadata rendered by the WebAppInstalls UI path. The install dialog trusts fields supplied by the page context without enforcing display constraints that would prevent misrepresentation of the requesting origin. Details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

Exploitation requires a victim to visit an attacker-controlled web page in a vulnerable Chrome build. The page triggers the web app install flow using standard web platform APIs while supplying content designed to distort the install prompt. User interaction is required to confirm installation, but the spoofed UI is engineered to appear legitimate. No authentication or privileged access is needed on the attacker side.

Since no verified proof-of-concept has been published, the vulnerability is described in prose only. See the Google Chrome Update advisory for release notes.

Detection Methods for CVE-2026-14381

Indicators of Compromise

Chrome browser version strings reporting builds earlier than 150.0.7871.46 in endpoint inventory data
Unexpected PWA or web app installation events on managed endpoints without change-control approval
Browser history or navigation records showing user visits to newly registered or low-reputation domains immediately preceding a web app install event

Detection Strategies

Inventory installed Chrome web applications through enterprise policy telemetry and flag installations sourced from untrusted origins
Correlate DNS and HTTP proxy logs with browser telemetry to identify sessions where install prompts were served from suspicious domains
Monitor for shortcut files and app profile directories created by the Chrome web app installer under user profile paths

Monitoring Recommendations

Enable Chrome Enterprise reporting to surface web app install events and extension activity centrally
Track browser version compliance across the fleet and alert on hosts running Chrome builds below the patched release
Review URL categorization data for spikes in access to newly observed domains hosting PWA manifests

How to Mitigate CVE-2026-14381

Immediate Actions Required

Update Google Chrome to version 150.0.7871.46 or later on all managed endpoints
Restart Chrome after updating to ensure the patched binaries are loaded into active browser sessions
Communicate user awareness guidance about verifying app identity before confirming installation prompts

Patch Information

Google has released the fix in Chrome Stable channel version 150.0.7871.46. Deploy the update through Chrome's automatic update mechanism, enterprise MDM tooling, or managed software distribution platforms. Refer to the Google Chrome Update announcement for full release details and channel notes.

Workarounds

Disable web app installation through Chrome Enterprise policy by setting WebAppInstallForceList restrictions and DefaultWebAppInstallation controls where feasible
Restrict browsing to allowlisted domains for high-risk user populations until patches are fully deployed
Train users to cancel install prompts on unfamiliar sites and verify PWA sources through official vendor channels

bash

# Configuration example - Chrome Enterprise policy to block web app installs
# Windows registry path
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome\WebAppInstallForceList = ""

# macOS/Linux managed preferences JSON fragment
{
  "WebAppInstallForceList": [],
  "DefaultWebAppInstallation": "block"
}