CVE-2026-79173: Google Chrome XSS Vulnerability

CVE-2026-79173 Overview

CVE-2026-79173 is a user interface (UI) misrepresentation vulnerability in the WebAppInstalls component of Google Chrome. Versions prior to 152.0.7977.65 allow a remote attacker to spoof UI elements by delivering a crafted HTML page. The flaw is classified under CWE-451: User Interface (UI) Misrepresentation of Critical Information. Google has rated the Chromium security severity as Medium. Successful exploitation requires user interaction with attacker-controlled web content but does not require authentication or elevated privileges.

Critical Impact
A remote attacker can spoof Chrome's Web App installation UI, tricking users into installing or trusting content that appears to originate from a legitimate source.

Affected Products

Google Chrome desktop versions prior to 152.0.7977.65
Chromium-based browsers that inherit the WebAppInstalls component before the upstream fix
Chrome installations across Windows, macOS, and Linux stable channels

Discovery Timeline

2026-08-25 - CVE-2026-79173 published to the National Vulnerability Database
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-79173

Vulnerability Analysis

The vulnerability resides in Chrome's WebAppInstalls subsystem, which handles Progressive Web App (PWA) installation prompts and related UI surfaces. A crafted HTML page can manipulate how these installation dialogs and associated UI elements render to the user. The result is a spoofing primitive: the attacker controls what the user perceives as an authoritative browser prompt. This class of flaw ([CWE-451]) undermines the trust boundary between browser chrome and page content. Attackers commonly abuse UI spoofing to support phishing, credential theft, and malicious app installation workflows.

Root Cause

The root cause is improper representation of security-relevant information in the WebAppInstalls UI path. Chrome fails to sufficiently isolate attacker-supplied content from trusted UI elements shown during web app installation. As a result, attacker-controlled strings or visuals can be presented in a way that appears to originate from Chrome itself or from a trusted origin.

Attack Vector

Exploitation is remote and requires the victim to visit a crafted web page. No authentication or special privileges are needed on the target system. The attacker hosts an HTML page that invokes the vulnerable WebAppInstalls flow with content designed to overlay, mimic, or obscure legitimate browser UI. Because no verified proof-of-concept has been published and no code samples are available, the exact DOM structure required is not disclosed here. Refer to the Chromium Issue Tracker Entry once restrictions are lifted for technical specifics.

Detection Methods for CVE-2026-79173

Indicators of Compromise

Outdated Chrome installations reporting a version string below 152.0.7977.65 in browser telemetry or asset inventory.
User reports of unexpected Web App installation prompts appearing during normal browsing sessions.
Newly installed PWAs on managed endpoints that were not requested by the user or approved by IT.

Detection Strategies

Inventory browser versions across the fleet and flag any Chrome build below 152.0.7977.65 for remediation.
Monitor web proxy and DNS logs for user navigation to newly registered or low-reputation domains preceding PWA install events.
Correlate endpoint process creation events for Chrome PWA launcher shortcuts with the originating URL to identify suspicious app installs.

Monitoring Recommendations

Enable browser management telemetry to report installed web apps, their origins, and install timestamps to a central log store.
Alert on unsigned or newly created .lnk and desktop entries associated with Chrome PWAs on user endpoints.
Track user-reported phishing incidents that reference browser prompts to identify UI spoofing patterns targeting your organization.

How to Mitigate CVE-2026-79173

Immediate Actions Required

Update Google Chrome to version 152.0.7977.65 or later on all managed endpoints.
Restart Chrome after the update to ensure the patched binaries are loaded into active processes.
Verify Chromium-based browsers (Edge, Brave, Opera, Vivaldi) have rolled the upstream fix and update them accordingly.

Patch Information

Google released the fix in the Chrome stable channel update announced in the Google Chrome Update Announcement. Upgrading to Chrome 152.0.7977.65 or later remediates CVE-2026-79173. Additional technical context is tracked in the Chromium Issue Tracker Entry.

Workarounds

Enforce automatic Chrome updates through enterprise policy so users receive fixes without manual intervention.
Restrict PWA installation using the WebAppInstallForceList and DefaultWebAppInstallEnabled Chrome enterprise policies until patching is complete.
Train users to verify installation prompts and to install web apps only from vetted, first-party domains.

bash

# Example Chrome enterprise policy to disable web app installs during remediation (Linux managed policy)
cat <<'EOF' > /etc/opt/chrome/policies/managed/webapp_install.json
{
  "DefaultWebAppInstallEnabled": false,
  "WebAppInstallForceList": []
}
EOF