CVE-2026-8019: Google Chrome WebApp XSS Vulnerability

CVE-2026-8019 Overview

CVE-2026-8019 is a user interface (UI) spoofing vulnerability in the WebApp component of Google Chrome. Versions prior to 148.0.7778.96 enforce insufficient policy on WebApp surfaces, allowing a remote attacker to mislead users through a crafted HTML page. Chromium classifies the security severity as Low, while the assigned CVSS v3.1 base score is 5.4. The flaw maps to CWE-451: User Interface (UI) Misrepresentation of Critical Information. Successful exploitation requires user interaction such as visiting an attacker-controlled page. There is no public proof-of-concept, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Attackers can spoof browser UI elements through a crafted HTML page, increasing the risk of credential theft and phishing against Chrome users on versions earlier than 148.0.7778.96.

Affected Products

Google Chrome desktop versions prior to 148.0.7778.96
Chrome WebApp component (installed Progressive Web Apps)
Chromium-based browsers that inherit the affected WebApp policy code

Discovery Timeline

2026-05-06 - CVE-2026-8019 published to the National Vulnerability Database
2026-05-06 - Last updated in the NVD database

Technical Details for CVE-2026-8019

Vulnerability Analysis

The vulnerability exists in Chrome's WebApp subsystem, which renders installed web applications in a window separated from the standard browser chrome. Insufficient policy enforcement allows a crafted HTML page to manipulate WebApp UI elements in ways that misrepresent origin or trust indicators. An attacker can leverage this to display content that appears to originate from a legitimate WebApp while actually being controlled by the attacker. The defect is a classic UI redress issue tracked under CWE-451. Exploitation does not grant code execution or direct data access. Instead, it weakens the visual security boundary that users rely on to make trust decisions.

Root Cause

The root cause is missing or incomplete enforcement of WebApp navigation and origin display policies. When a malicious page is loaded inside a WebApp context, Chrome fails to consistently render trust indicators that would expose the actual origin. Refer to the Chromium Issue Tracker Entry for additional context.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a crafted HTML page and lures the victim to load it inside a WebApp window, for example through a link from an installed PWA. Once loaded, the page renders spoofed UI to impersonate trusted content such as login prompts or system dialogs. The Chromium severity rating is Low because impact is limited to deception rather than direct compromise.

No verified proof-of-concept code is available. See the Google Chrome Update Advisory for upstream details.

Detection Methods for CVE-2026-8019

Indicators of Compromise

Chrome browser process versions earlier than 148.0.7778.96 running on managed endpoints
WebApp windows rendering external origins that do not match the installed application's manifest scope
User reports of credential prompts or dialogs appearing inside installed PWAs that look unfamiliar

Detection Strategies

Inventory installed Chrome versions across the fleet and flag hosts on builds prior to 148.0.7778.96
Correlate phishing-related email or web telemetry with subsequent navigation events from chrome.exe launched with WebApp flags such as --app-id
Hunt in browser history and proxy logs for WebApp navigations to domains outside the manifest scope of installed PWAs

Monitoring Recommendations

Enable browser version reporting through Chrome Enterprise policy and ingest results into the SIEM
Monitor DNS and HTTP egress for newly registered domains accessed within WebApp sessions
Track endpoint user-agent strings to identify hosts still running pre-148 Chrome builds after the rollout window

How to Mitigate CVE-2026-8019

Immediate Actions Required

Update Google Chrome to version 148.0.7778.96 or later on all desktop platforms
Force a Chrome relaunch through endpoint management to apply the patched binary on running sessions
Audit installed WebApps and remove any PWAs that are unused or sourced from untrusted origins

Patch Information

Google addressed CVE-2026-8019 in the Stable channel update referenced in the Google Chrome Update Advisory. The fix ships in Chrome 148.0.7778.96 and later. Chromium-based browsers should pick up the corresponding patch from upstream. Track remediation progress against the Chromium Issue Tracker Entry.

Workarounds

Restrict installation of new WebApps using the WebAppInstallForceList and WebAppSettings enterprise policies
Train users to verify origin information before entering credentials in any WebApp window
Block known phishing infrastructure at the secure web gateway to reduce exposure to crafted HTML pages

bash

# Configuration example: enforce minimum Chrome version via Chrome Enterprise policy (Linux managed JSON)
# /etc/opt/chrome/policies/managed/cve-2026-8019.json
{
  "TargetVersionPrefix": "148.0.7778.",
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000,
  "WebAppSettings": [
    {
      "manifest_id": "*",
      "run_on_os_login": "blocked"
    }
  ]
}