CVE-2026-3935: Google Chrome XSS Vulnerability

CVE-2026-3935 Overview

CVE-2026-3935 is a user interface spoofing vulnerability in the WebAppInstalls component of Google Chrome before version 146.0.7680.71. A remote attacker can craft a malicious HTML page that misrepresents the security UI presented during a web application install flow. The flaw is tracked under CWE-451: User Interface (UI) Misrepresentation of Critical Information and was rated Medium by the Chromium security team. Exploitation requires user interaction, which limits drive-by scenarios but supports phishing and social engineering chains targeting Chrome users on Windows, macOS, and Linux.

Critical Impact
Attackers can deceive users into installing or trusting web applications by displaying misleading security indicators in the Chrome install prompt.

Affected Products

Google Chrome prior to 146.0.7680.71
Chrome desktop builds running on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that inherit the WebAppInstalls component without backporting the fix

Discovery Timeline

2026-03-11 - CVE-2026-3935 published to the National Vulnerability Database
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-3935

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem, which handles the installation flow for Progressive Web Apps (PWAs) and other installable web applications. Chrome renders an install prompt that displays the origin, name, and icon of the application requesting installation. Incorrect rendering of this security UI permits a crafted HTML page to misrepresent the true identity or origin of the application being installed.

Because the install dialog is the user's primary trust signal before granting an application persistent desktop presence, a spoofed prompt undermines the integrity assurances Chrome provides. The issue is classified as a UI misrepresentation flaw [CWE-451] rather than a memory safety bug, so successful exploitation does not yield direct code execution. Instead, it expands the attack surface for credential harvesting and malware delivery through fraudulent installed apps.

Root Cause

The root cause is improper construction or sanitization of fields rendered in the web app install prompt within the WebAppInstalls component. Attacker-supplied manifest values or page content can manipulate what the user perceives as the source and nature of the application. Details of the underlying fix are tracked in the Chromium Issue Tracker entry 479326680.

Attack Vector

Exploitation requires a victim to visit a crafted HTML page and proceed through a web app install interaction. The attacker controls page content and manifest data to render a misleading install prompt that mimics a legitimate vendor or origin. Once installed, the spoofed application gains the persistent, browser-integrated foothold that users typically reserve for trusted sites, including stored credentials, notifications, and a launcher icon. No verified proof-of-concept code is publicly available for this issue.

Detection Methods for CVE-2026-3935

Indicators of Compromise

Newly installed Progressive Web Apps under user profile directories with manifests pointing to recently registered or low-reputation domains
Browser history showing navigation to suspicious pages immediately preceding a PWA install event
Desktop shortcuts or Start Menu entries referencing chrome_proxy.exe --app-id=<id> with unfamiliar app identifiers

Detection Strategies

Inventory installed web apps across managed endpoints by enumerating the Chrome Web Applications directory inside each user profile
Alert on Chrome process launches using the --app-id flag for app identifiers that are not on an approved allow list
Correlate user-reported phishing or impersonation incidents with browser telemetry showing recent WebAppInstalls activity

Monitoring Recommendations

Track Chrome version distribution and flag any endpoints running versions earlier than 146.0.7680.71
Monitor creation of files in %LOCALAPPDATA%\Google\Chrome\User Data\<Profile>\Web Applications\ on Windows and equivalent paths on macOS and Linux
Forward browser and endpoint telemetry to a centralized analytics platform for retroactive hunting against newly identified spoofing domains

How to Mitigate CVE-2026-3935

Immediate Actions Required

Update Google Chrome to version 146.0.7680.71 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update to ensure the patched WebAppInstalls component is loaded
Audit existing installed web apps and remove any that cannot be attributed to a sanctioned business need

Patch Information

Google addressed CVE-2026-3935 in the stable channel release announced in the Google Chrome stable channel update for desktop. Administrators should ensure Chrome auto-update is enabled or push the fixed build through enterprise management tooling.

Workarounds

Disable web app installation via the WebAppInstallForceList and DefaultWebAppInstallationForceAllowed enterprise policies, restricting installs to vetted origins
Train users to scrutinize install prompts and to cancel any web app installation that was not explicitly initiated
Use enterprise policy to block navigation to untrusted domains capable of triggering install flows

bash

# Example Chrome enterprise policy (Windows registry) restricting web app installs
reg add "HKLM\Software\Policies\Google\Chrome" /v WebAppInstallForceList /t REG_SZ /d "[]" /f
reg add "HKLM\Software\Policies\Google\Chrome" /v DefaultWebAppInstallationForceAllowed /t REG_DWORD /d 0 /f