CVE-2026-17819: Google Chrome XSS Vulnerability

CVE-2026-17819 Overview

CVE-2026-17819 is a user interface spoofing vulnerability in the WebAppInstalls component of Google Chrome. The flaw stems from an inappropriate implementation that a remote attacker can leverage through a crafted HTML page. Chromium engineers rated the security severity as Medium. All Chrome desktop builds prior to 151.0.7922.72 are affected. Google addressed the issue in the Stable channel update announced on the Chrome Releases blog, with additional context available on the Chromium Issue Tracker.

Critical Impact
Remote attackers can spoof browser UI elements associated with Progressive Web App installation, tricking users into installing or trusting malicious web applications.

Affected Products

Google Chrome for desktop prior to 151.0.7922.72
Chromium-based browsers that embed the vulnerable WebAppInstalls code path
Any deployment pinned to Chrome builds below the fixed Stable channel release

Discovery Timeline

2026-07-30 - CVE-2026-17819 published to the National Vulnerability Database
2026-07-30 - Record last modified in NVD

Technical Details for CVE-2026-17819

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem, the component responsible for handling Progressive Web App (PWA) installation prompts and related user consent surfaces. An inappropriate implementation in this code path allows attacker-controlled web content to influence UI elements the user relies on to make trust decisions. Because the deception targets the browser's own installation flow, users cannot readily distinguish attacker-supplied content from legitimate Chrome UI.

UI spoofing weaknesses fall under [CWE-451: User Interface (UI) Misrepresentation of Critical Information] and are commonly used as building blocks for phishing and social engineering campaigns. In this case, exploitation converts a routine web visit into a plausible install prompt, which can lead a target to grant elevated permissions to a malicious PWA.

Root Cause

The root cause is an implementation defect in how WebAppInstalls renders or gates installation-related UI. The component does not sufficiently isolate trusted browser chrome from content originating in a crafted HTML page. Google has not published low-level implementation details, consistent with its standard disclosure practice for medium-severity Chromium issues.

Attack Vector

Exploitation is remote and requires user interaction. An attacker hosts a crafted HTML page and lures a victim to visit it, typically via phishing, malvertising, or a compromised site. The page manipulates the WebAppInstalls surface to display misleading content, prompting the victim to accept an installation or authorization step under false pretenses.

No verified proof-of-concept code has been published. See the Chromium Issue Tracker entry for status once Google releases restricted bug details.

Detection Methods for CVE-2026-17819

Indicators of Compromise

Chrome desktop clients reporting a version string below 151.0.7922.72 in browser telemetry or user-agent logs
Unexpected PWA installations under %LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Applications\ on Windows or the equivalent profile paths on macOS and Linux
Outbound connections from newly installed web app processes to domains not associated with sanctioned business applications

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build below 151.0.7922.72
Monitor creation of new entries in the Chrome Web Applications directory and correlate with the originating browsing session
Alert on browser-launched child processes that load PWA manifests from recently registered or low-reputation domains

Monitoring Recommendations

Ingest Chrome update and version telemetry into your SIEM to track patch adoption over time
Enable URL and phishing analytics on the corporate proxy to identify landing pages that host crafted install prompts
Track user reports of unexpected Chrome install dialogs and route them to the security operations queue for review

How to Mitigate CVE-2026-17819

Immediate Actions Required

Update all Google Chrome desktop installations to 151.0.7922.72 or later
Trigger managed update policies through Google Update, Group Policy, or your endpoint management platform to force restart of the browser
Audit installed PWAs and remove any that users cannot attribute to a legitimate business workflow

Patch Information

Google released the fix in the Stable channel update for desktop referenced in the Chrome Releases announcement. Administrators should confirm that endpoints report 151.0.7922.72 or higher and that automatic updates are not blocked by proxy or firewall rules.

Workarounds

Restrict PWA installation using the WebAppInstallForceList and DefaultWebAppInstallSource enterprise policies to limit the attack surface
Set WebAppSettings to block installation from arbitrary origins where PWAs are not required for business use
Deliver targeted user awareness guidance to help staff recognize unexpected install prompts until patch deployment completes

bash

# Configuration example
# Verify the installed Chrome version on Windows
reg query "HKLM\SOFTWARE\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux
google-chrome --version